Cisco disclosed a CVSS 9.8 critical vulnerability class in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, found during an internal security review and fixed via software hardening releases.
What Is It
CVE-2026-20353 covers a set of vulnerabilities identified by Cisco's own engineering team during a comprehensive internal security review of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The issues involve improper control of a resource through its lifetime, grouped under CWE-664 (a CWE Pillar-level weakness). Cisco's PSIRT is the CNA and assigned the identifier; the review produced hardening releases rather than a single point patch.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That combination is the worst-case profile: reachable over the network, low attack complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment scores the technical impact as total and marks the flaw automatable: yes, meaning an attacker could reliably script exploitation at scale.
The counterweight: CISA's SSVC entry records exploitation as none, and no CISA KEV entry was supplied for this CVE, there is no evidence in the source material of active exploitation in the wild. NVD status is "Awaiting Analysis" as of publication on 2026-09-14.
What's Vulnerable
Cisco Secure Email, across a wide span of release trains. Affected versions listed by Cisco include:
- 13.x: 13.0.0-392, 13.0.5-007, 13.5.1-277, 13.5.4-038
- 14.x: 14.0.0-698, 14.2.0-620, 14.2.1-020, 14.3.0-032
- 15.0.x: 15.0.0-104, 15.0.1-030, 15.0.3-002, 15.0.5-016
- 15.5.x: 15.5.0-048, 15.5.1-055, 15.5.2-018, 15.5.3-022, 15.5.4-012
- 16.x: 16.0.0-050, 16.0.0-054, 16.0.1-017, 16.0.2-112, 16.0.3-044, 16.0.4-016
No CPE data has been published yet. Note that even the most recent 16.0.x builds appear on the affected list.
Patch Status
Cisco has published software hardening releases addressing these vulnerabilities. Administrators should consult the Cisco security advisory below for fixed-release mapping and upgrade to a hardened build. No workarounds or mitigations are documented in the supplied source material, and no KEV-mandated remediation deadline applies.
Sources
- NVD, CVE-2026-20353: https://nvd.nist.gov/vuln/detail/CVE-2026-20353
- Cisco Security Advisory (cisco-sa-hardening-esa-dfCrfXkm): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm