CVE-2026-20354
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.15%
- CWE
- CWE-354
- Published
- 2026-09-02
- Last modified
- 2026-09-02
Affected products
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
- Cisco Cisco Secure Email
Weakness type
Related vulnerabilities
- CVE-2026-72929 — Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-82549 — Linux Foundation Magma SecurityModeComplete integrity check
- CVE-2026-75803 — AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
- CVE-2026-75625 — Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
- CVE-2026-12817 — OpenPGP AEAD decryption skips final tag on chunk-aligned data
- CVE-2026-12816 — IESEngine stream-mode MAC forgery via length-dependent KDF split
- CVE-2026-12803 — KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
- CVE-2026-12802 — CMS AuthEnvelopedData fails to enforce tag-length on decryption