CVE-2026-20355: Insufficient Verification of Data Authenticity in Cisco Cisco Secure Email

This vulnerability in Cisco Secure Email's S/MIME decryption functionality arises from insufficient validation of message integrity. An attacker could exploit this by performing a man-in-the-middle attack to intercept and alter traffic between email gateways, potentially recovering plaintext content from encrypted email communications. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation could allow an unauthenticated remote attacker to obtain plaintext content from encrypted email messages, compromising confidentiality. There is no impact on integrity or availability. The attack requires high complexity and a man-in-the-middle position between email gateways.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Cisco advisories for updates and apply patches once available.