Vulnerability · Published Sep 2, 2026 · Assigned by cisco
CVE-2026-20355Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Medium 5.9
In plain English
A medium-severity insufficient verification of data authenticity in Cisco Secure Email from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Secure Email | 14.0.0-69813.5.1-27713.0.0-39214.2.0-62013.0.5-00713.5.4-03814.2.1-02014.3.0-032 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N