CVE-2026-20353

Cisco Secure Email Gateway Security Hardening Release

Published Sep 14, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

Analysis

Technical impact

The vulnerability arises from improper control of a resource throughout its lifetime, a flaw categorized under CWE-664. The flaw can allow a malicious actor to misuse the resource, potentially leading to unauthorized actions or escalation of privileges, as reflected by the CVSS score of 9.8.

Affected Systems

Cisco Secure Email Gateway devices are affected. Specific advisory, so all installations of Cisco Secure Email Gateway should be considered potentially vulnerable until a patch is applied.

Risk and Exploitability

The high CVSS score indicates the vulnerability is severe; the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the gateway’s administrative or management interfaces, given the nature of the flaw and the environment in which Cisco Secure Email operates. While no exploitation data is supplied, the potential for remote exploitation exists based on the severity rating.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Secure Email

unknown

Version	Status	Constraints
`14.0.0-698`	affected	—
`13.5.1-277`	affected	—
`13.0.0-392`	affected	—
`14.2.0-620`	affected	—
`13.0.5-007`	affected	—
`13.5.4-038`	affected	—
`14.2.1-020`	affected	—
`14.3.0-032`	affected	—
`15.0.0-104`	affected	—
`15.0.1-030`	affected	—
`15.5.0-048`	affected	—
`15.5.1-055`	affected	—
`15.5.2-018`	affected	—
`16.0.0-050`	affected	—
`15.0.3-002`	affected	—
`16.0.0-054`	affected	—
`15.5.3-022`	affected	—
`16.0.1-017`	affected	—
`15.5.4-012`	affected	—
`16.0.4-016`	affected	—
`15.0.5-016`	affected	—
`16.0.2-112`	affected	—
`16.0.3-044`	affected	—

No data.

Vendor Product Versions

Cisco

Secure Email

Version	Status	Scheme	Platform
`14.0.0-698`	affected	semver	—
`13.5.1-277`	affected	semver	—
`13.0.0-392`	affected	semver	—
`14.2.0-620`	affected	semver	—
`13.0.5-007`	affected	semver	—
`13.5.4-038`	affected	semver	—
`14.2.1-020`	affected	semver	—
`14.3.0-032`	affected	semver	—
`15.0.0-104`	affected	semver	—
`15.0.1-030`	affected	semver	—
`15.5.0-048`	affected	semver	—
`15.5.1-055`	affected	semver	—
`15.5.2-018`	affected	semver	—
`16.0.0-050`	affected	semver	—
`15.0.3-002`	affected	semver	—
`16.0.0-054`	affected	semver	—
`15.5.3-022`	affected	semver	—
`16.0.1-017`	affected	semver	—
`15.5.4-012`	affected	semver	—
`16.0.4-016`	affected	semver	—
`15.0.5-016`	affected	semver	—
`16.0.2-112`	affected	semver	—
`16.0.3-044`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Cisco Secure Email Gateway hardening release to all affected appliances.
Reconfigure the system to enforce strict initialization and cleanup of resources according to Cisco’s recommended settings.
Implement monitoring of resource usage and anomalies associated with improper control.

Generated by OpenCVE AI on September 20, 2026 at 23:54 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.530% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification

History

Sep 17, 2026 9:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco secure Email
Vendors & Products		Cisco Cisco secure Email

Sep 15, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
Title		Cisco Secure Email Gateway Security Hardening Release
Weaknesses		CWE-664
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`