CVE-2026-20354

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-02 17:17

Updated : 2026-09-02 19:23

NVD link : CVE-2026-20354

Mitre link : CVE-2026-20354

CVE.ORG link : CVE-2026-20354

JSON object : View

Products Affected

No product.

CWE

CWE-354

Improper Validation of Integrity Check Value

{"id": "CVE-2026-20354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20354", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T16:49:02.578484Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Secure Email", "versions": [{"status": "affected", "version": "14.0.0-698"}, {"status": "affected", "version": "13.5.1-277"}, {"status": "affected", "version": "13.0.0-392"}, {"status": "affected", "version": "14.2.0-620"}, {"status": "affected", "version": "13.0.5-007"}, {"status": "affected", "version": "13.5.4-038"}, {"status": "affected", "version": "14.2.1-020"}, {"status": "affected", "version": "14.3.0-032"}, {"status": "affected", "version": "15.0.0-104"}, {"status": "affected", "version": "15.0.1-030"}, {"status": "affected", "version": "15.5.0-048"}, {"status": "affected", "version": "15.5.1-055"}, {"status": "affected", "version": "15.5.2-018"}, {"status": "affected", "version": "16.0.0-050"}, {"status": "affected", "version": "15.0.3-002"}, {"status": "affected", "version": "16.0.0-054"}, {"status": "affected", "version": "15.5.3-022"}, {"status": "affected", "version": "16.0.1-017"}, {"status": "affected", "version": "15.5.4-012"}, {"status": "affected", "version": "16.0.4-016"}, {"status": "affected", "version": "15.0.5-016"}, {"status": "affected", "version": "16.0.2-112"}, {"status": "affected", "version": "16.0.3-044"}, {"status": "affected", "version": "16.5.0-780"}], "defaultStatus": "unknown"}]}], "published": "2026-09-02T17:17:33.897", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.\r\n\r\nThese vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication."}], "lastModified": "2026-09-02T19:23:13.660", "sourceIdentifier": "psirt@cisco.com"}