CVE-2026-20354
CVE-2026-20354 is covered by the cisco-sa-esa-smime-disc-dzw4rEdY security bulletin. Not in the CISA KEV catalog. Medium advisory severity.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Cisco publishes the next one.
VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-20354 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- Vendor advisories
- 2 from Cisco
- VulniPulse record
- Published · Updated
Is CVE-2026-20354 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-20354 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-20354?
This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.
Vendor advisory comparison
Cisco
2 advisories- Advisory severityMedium5.9
Medium [CVE-2026-20354 +1] Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities
cisco-sa-esa-smime-disc-dzw4rEdYSource published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity.
- Affected products in this advisory
- Secure Email
- Source-reported affected versions
- Scope: At the time of publication, these vulnerabilities affected Cisco Secure Email devices if they were running Cisco AsyncOS Software Release 16.5.0 or earlier and had S/MIME configured for communication between email gateways.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- There are no workarounds that address these vulnerabilities.
- Advisory severityUnrated
Advisory [CVE-2026-20212 +10] Cisco Advance Notification for Publication of September 2, 2026, Security Advisories
cisco-sa-notice-f2SiMFxlSource published Source updated
This bulletin covers 11 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 Critical 9.8 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability High 7.5 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities Medium 5.9 To remediate the vulnerabilities that were disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Desk Phone 9800, 7800 and 8800, and 8875 Series Software IOS XR Software (security hardening release) Nexus 9000 Series Switches Silicon One Secure Email To fully remediate vulnerabilities to be disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.
More Cisco advisories
- CVE-2026-76519Oct 14, 2026Cisco Secure Email Gateway Arbitrary File Write Vulnerability
- CVE-2026-76461Sep 14, 2026Cisco Secure Email Gateway SQL Injection Vulnerability
- CVE-2026-20213Jul 2, 2026ClamAV Vulnerabilities Affecting Cisco Products: July 2026
- CVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- cisco-sa-notice-I8z3n6lKOct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
- CVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Follow CVE-2026-20354 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.