Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.

These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00149.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Email unknown
Version Status Constraints
14.0.0-698 affected —
13.5.1-277 affected —
13.0.0-392 affected —
14.2.0-620 affected —
13.0.5-007 affected —
13.5.4-038 affected —
14.2.1-020 affected —
14.3.0-032 affected —
15.0.0-104 affected —
15.0.1-030 affected —
15.5.0-048 affected —
15.5.1-055 affected —
15.5.2-018 affected —
16.0.0-050 affected —
15.0.3-002 affected —
16.0.0-054 affected —
15.5.3-022 affected —
16.0.1-017 affected —
15.5.4-012 affected —
16.0.4-016 affected —
15.0.5-016 affected —
16.0.2-112 affected —
16.0.3-044 affected —
16.5.0-780 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Cisco Subscribe
Secure Email Subscribe

Project Subscriptions

Vendors Products
Cisco Subscribe
Secure Email Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY cve-icon cve-icon
History

Thu, 03 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco secure Email
Vendors & Products Cisco
Cisco secure Email

Wed, 02 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Title Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Weaknesses CWE-354
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-09-02T17:58:58.074Z

Reserved: 2025-10-08T11:59:15.414Z

Link: CVE-2026-20354

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T17:17:33.897

Modified: 2026-09-02T19:23:13.660

Link: CVE-2026-20354

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:30:05Z

Weaknesses