—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple Vulnerabilities in Cisco Secure Email

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: MEDIUM

Software Affected

Cisco Secure Email (running Cisco AsyncOS Software Release 16.5.0 or earlier and having S/MIME configured for communication between email gateways)

Overview

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.

Target Audience:

All IT administrators and individuals using Cisco products.

Risk Assessment:

Risk of information disclosure.

Impact Assessment:

Potential for disclosure of sensitive information and compromise of confidentiality.

Description

These vulnerabilities exist in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email due to insufficient validation of message integrity. An attacker could exploit the vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways.

Successful exploitation could allow an unauthenticated, remote attacker to obtain plaintext content from encrypted communication.

Solution

Apply appropriate security update as mentioned in CISCO advisory:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY

Vendor Information

Cisco

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY

References

 

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY

CVE Name

CVE-2026-20354

CVE-2026-20355

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmqirFoACgkQ3jCgcSdc

ys/CFg//X9A2H87BKj0bHaxXN9mOW7A5YN4eKrsnVJDqFxf3A3IQGhP2wHn1qAQh

+eQs/ZYjtdxHWLQbWzQ+m+y64Y+Lv+lkIiR8J9ZkxL88IRNvKyMPSHFJHJkkJVfv

Ok8LFDbZxTp2R0qxRbf91oGygE1eTknqp0Y6Zcc6ono5FdnBoLxA2R9BGk7nht0F

kx/f7abnVP2Mj9nfMGyVCO+xE3LyAW2yWj1mZuCI33rCKaAheQw6I6xKNYEDB6oL

MIrkuPtcMNR7e5elEr52UrOgUmTBQ4QTocVS5AXIyUWNqmvjxX6NfjVGSG34CUr+

cHoQsLhdh7COX+XuD+FIKR8uJBxGZXb+1Jzu3ZX1v+g8Ij9xB3BVG4ZRoreGQgf+

z2/cAi//R/TskRxHXW/Y09oB1gWs+taWJlQX5TNuOfBnInjI2Tl0Hpujizx3a7ux

eH4Wv8enIbTkJArbC4G7U2/l8ROXgubtbBE77N1WaxJEdrT2Pc1iOktGqDx5MY3E

edCauQ1Iic8YdVgIUGUfFPvPUha8qgkmF8y7Wa6Jlw3FSaft04PCLSLCpni++TZ/

42FAdUwaGG0I2S1Fs+ur92N7NN5VpVLtjiFHEijOSrz2J/C1Ga/WtQl9mgMsx4kI

oIpI4FMiRdN6O3eD27iy1plslOWkvAKS9N1oOwHJtBXL7tVvtlg=

=gH4X

—–END PGP SIGNATURE—–