EUVD-2026-70210
GHSA-x26v-65cq-x3px
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects mandatory MITM network positioning; C:H captures full plaintext email recovery; no integrity or availability impact applies.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.
These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
AnalysisAI
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to be met simultaneously: first, the attacker must achieve a machine-in-the-middle network position between two Cisco Secure Email gateway hosts exchanging S/MIME-encrypted messages - this cannot be done remotely from an arbitrary internet vantage point and requires control of an intermediate network path via BGP hijacking, ARP poisoning, a compromised transit relay, or similar technique. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.9 (Medium) is calibrated appropriately given the AC:H constraint - exploitation demands a machine-in-the-middle network position between email gateways, which is a non-trivial prerequisite not achievable through simple remote access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Administrators should consult Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY for the official fixed release version, as no specific patched version number is available in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Secure Email
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today