Cisco published a batch of security advisories on 2 September 2026. Two medium-severity flaws in Cisco Secure Email S/MIME decryption, CVE-2026-20354 and CVE-2026-20355 (Cisco CVSS 5.9 each), are due to insufficient validation of message integrity: Cisco says an attacker using a machine-in-the-middle technique to intercept and modify traffic between email gateways could obtain plaintext content from the encrypted communication.

Cisco says that at the time of publication the flaws affected Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME configured for communication between email gateways, that a public announcement of the flaws is available, and that it is not aware of any malicious use.

In the same publication, Cisco's notice lists the IOS XR Software Security Hardening Release for September 2026 (CVE-2026-20274 to CVE-2026-20280; Critical, CVSS 9.8), a Nexus 9000 Series Switches Silicon One remote code execution flaw (CVE-2026-20212; Critical, CVSS 9.8) and a high-severity SIP denial-of-service flaw in Desk Phone 9800, IP Phone 7800 and 8800 and Video Phone 8875 (CVE-2026-20281; CVSS 7.5), and recommends upgrading to the fixed software indicated in each advisory. (sources: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY; Cisco's publication notice)

Apply available IOS XR, Nexus and phone fixes; for Secure Email, Cisco says there are no workarounds and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases.

Correction (25 Oct 2026): Cisco's advisory (version 1.1, updated 8 September) says there are no workarounds for CVE-2026-20354 and CVE-2026-20355 and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases; the earlier advice to apply workarounds from the advisory was wrong and has been removed. (source: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY)

Correction (26 Oct 2026): CVSS scores and fix status are now credited to Cisco's advisory and publication notice. An unlinked SecurityWeek summary and wording that came from it (the flaws described as unpatched, 'no fix at disclosure', and descriptions of the IOS XR flaw classes and the Nexus attack path) have been removed. (source: Cisco)