CVE-2026-20354: Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Deployments of Cisco Secure Email that use S/MIME decryption are exposed when an attacker can act as a machine in the middle between email gateways and intercept and modify their traffic.
Does exploitation require an authenticated account or user interaction?
No. The attacker is unauthenticated and exploitation does not require user interaction, but it requires the ability to intercept and alter traffic between email gateways.
What is the impact of a successful attack?
A successful attack can allow recovery of plaintext content from encrypted email communications. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.