5.9
CVE-2026-20355
- EPSS 0.15%
- Veröffentlicht 02.09.2026 16:14:32
- Zuletzt bearbeitet 02.09.2026 19:23:13
- Erkennungen
Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt
Cisco Secure Email
Default Statusunknown
Version
14.0.0-698
Status
affected
Version
13.5.1-277
Status
affected
Version
13.0.0-392
Status
affected
Version
14.2.0-620
Status
affected
Version
13.0.5-007
Status
affected
Version
13.5.4-038
Status
affected
Version
14.2.1-020
Status
affected
Version
14.3.0-032
Status
affected
Version
15.0.0-104
Status
affected
Version
15.0.1-030
Status
affected
Version
15.5.0-048
Status
affected
Version
15.5.1-055
Status
affected
Version
15.5.2-018
Status
affected
Version
16.0.0-050
Status
affected
Version
15.0.3-002
Status
affected
Version
16.0.0-054
Status
affected
Version
15.5.3-022
Status
affected
Version
16.0.1-017
Status
affected
Version
15.5.4-012
Status
affected
Version
16.0.4-016
Status
affected
Version
15.0.5-016
Status
affected
Version
16.0.2-112
Status
affected
Version
16.0.3-044
Status
affected
Version
16.5.0-780
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.044 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| Cisco PSIRT | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-345 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY