EUVD-2026-70211
GHSA-4rjc-g85j-x387
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
MITM network positioning is required (AC:H, AV:N); no auth or user interaction needed; only confidentiality is impacted, not integrity or availability.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.
These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.
AnalysisAI
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to achieve a machine-in-the-middle network position between email gateways - specifically, the ability to intercept and modify SMTP traffic carrying S/MIME-encrypted messages in transit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects two competing signals: the confidentiality impact is high (full plaintext recovery), but the attack complexity is high because the attacker must achieve a machine-in-the-middle position between email gateways - a prerequisite that is non-trivial but achievable via BGP hijacking, DNS poisoning, or compromise of a transit network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY for patched releases and upgrade instructions - specific fixed version numbers are not confirmed from the provided data and should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Secure Email
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today