Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

Cisco reported two publicly disclosed medium-severity vulnerabilities (CVE-2026-20354 and CVE-2026-20355) in its Secure Email product affecting S/MIME decryption due to insufficient message integrity validation, enabling man-in-the-middle attackers to obtain plaintext from encrypted communications. All Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME enabled are affected. Cisco also patched multiple critical vulnerabilities in IOS XR and Nexus 9000 series switches, including memory corruption, memory safety, improper access control, and remote code execution bugs (notably CVE-2026-20274, CVE-2026-20279, and CVE-2026-20212, each with CVSS 9.8). Additionally, a high-severity denial-of-service vulnerability (CVE-2026-20281) affecting Cisco Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875 series using SIP was fixed. Cisco is unaware of any exploitation in the wild. Patches are available for IOS XR, Nexus switches, and IP phones; however, the Secure Email vulnerabilities remain unpatched.

The Secure Email S/MIME flaws could allow attackers performing man-in-the-middle attacks to intercept and modify encrypted email traffic, exposing plaintext content. The critical IOS XR and Nexus switch vulnerabilities could lead to remote code execution, authentication bypass, and code injection, potentially allowing attackers to fully compromise affected network devices. The IP phone vulnerability could cause denial-of-service conditions via crafted HTTP packets. No known exploitation in the wild has been reported for any of these vulnerabilities.

Cisco has released official patches addressing the critical vulnerabilities in IOS XR, Nexus 9000 series switches, and affected IP phone models. Organizations should apply these patches promptly. For the Secure Email S/MIME vulnerabilities, Cisco has not yet released a patch; therefore, monitor Cisco advisories for updates. No active exploitation is known, but caution is advised when using affected Secure Email versions with S/MIME enabled.