Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.

These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Email unknown
Version Status Constraints
14.0.0-698 affected —
13.5.1-277 affected —
13.0.0-392 affected —
14.2.0-620 affected —
13.0.5-007 affected —
13.5.4-038 affected —
14.2.1-020 affected —
14.3.0-032 affected —
15.0.0-104 affected —
15.0.1-030 affected —
15.5.0-048 affected —
15.5.1-055 affected —
15.5.2-018 affected —
16.0.0-050 affected —
15.0.3-002 affected —
16.0.0-054 affected —
15.5.3-022 affected —
16.0.1-017 affected —
15.5.4-012 affected —
16.0.4-016 affected —
15.0.5-016 affected —
16.0.2-112 affected —
16.0.3-044 affected —
16.5.0-780 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY cve-icon cve-icon
History

Wed, 02 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Title Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Weaknesses CWE-345
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-09-02T17:58:57.899Z

Reserved: 2025-10-08T11:59:15.414Z

Link: CVE-2026-20355

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T17:17:34.027

Modified: 2026-09-02T19:23:13.660

Link: CVE-2026-20355

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses