What’s Vulnerable › Vulnerabilities
CVE-2026-20354: Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-02
- Weakness: CWE-354
Description
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Affected products
- Cisco Email Security Appliance (ESA): 14.0.0-698, 13.5.1-277, 13.0.0-392, 14.2.0-620, 13.0.5-007, 13.5.4-038 (+18)
References
Get alerted when CVE-2026-20354 or the next vulnerability affects your stack