CVE-2026-20354
Received Received - Intake

S/MIME Decryption Plaintext Recovery in Cisco Secure Email

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Cisco Systems, Inc.

Description
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-20354
EUVD
EUVD-2026-70210

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cisco secure_email *
cisco secure_email to 16.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves flaws in the S/MIME decryption feature of Cisco Secure Email. It allows unauthenticated remote attackers to decrypt and recover plaintext from encrypted emails due to weak message integrity checks. Exploitation requires a machine-in-the-middle attack to intercept and alter traffic between email gateways.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual decryption failures or integrity checks in S/MIME traffic. Inspect logs for Cisco Secure Email devices for anomalies in S/MIME decryption processes. Use network monitoring tools to detect machine-in-the-middle attacks by analyzing traffic patterns between email gateways.

Impact Analysis

If exploited, this vulnerability could expose sensitive email content to attackers, potentially leading to data breaches or unauthorized access to confidential information. It affects systems running Cisco Secure Email with S/MIME configured for gateway communication.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information. Organizations using affected Cisco Secure Email systems may face legal and regulatory penalties due to unauthorized data access.

Mitigation Strategies

Immediately upgrade Cisco Secure Email devices running AsyncOS Software Release 16.5.0 or earlier to a fixed software release. Disable S/MIME gateway communication if not required. Monitor for suspicious traffic patterns and ensure no unauthorized modifications to encrypted email traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart