CVE-2026-20354: Improper Validation of Integrity Check Value in Cisco Cisco Secure Email

This vulnerability affects the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption process in Cisco Secure Email. Due to insufficient validation of the integrity check value, an attacker performing a man-in-the-middle attack could intercept and alter encrypted email traffic between gateways, potentially recovering the plaintext content of the encrypted messages. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high complexity and no privileges required, impacting confidentiality but not integrity or availability.

An attacker exploiting this vulnerability could obtain plaintext content from encrypted email communications, compromising the confidentiality of sensitive information transmitted via Cisco Secure Email. There is no indication of impact on message integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Users should monitor Cisco advisories for updates and apply patches once available.