Cisco Discloses New Vulnerabilities in Secure Email, IOS XR, Nexus 9000 Switches, and IP Phones

Cisco published a series of advisories on September 2, 2026, covering email infrastructure, network appliances, and VoIP endpoints. The most serious issues could allow remote code execution, compromise with root privileges, or denial of service.

Two medium-severity vulnerabilities affect S/MIME decryption in Cisco Secure Email. In this case, a machine-in-the-middle attacker could recover the plaintext content of encrypted messages.

Operational priority depends on the exposure of individual assets. IOS XR and Nexus 9000 carry the highest technical risk, while Secure Email directly affects the confidentiality of communications.

Secure Email May Disclose the Content of S/MIME Messages

CVE-2026-20354 and CVE-2026-20355 affect the function Cisco Secure Email uses to decrypt messages protected with Secure/Multipurpose Internet Mail Extensions, or S/MIME.

The root cause is insufficient message-integrity validation. Cisco links the two CVEs to the internal bugs CSCwu28362 and CSCwu28364, as well as to CWE-345 and CWE-354, both of which involve inadequate validation of data authenticity or integrity.

To exploit the flaws, an unauthenticated remote attacker must be able to position themselves between the email gateways. The attacker can then intercept and modify communications, causing the vulnerable system to process manipulated S/MIME content.

If the attack succeeds, the attacker can recover the plaintext of encrypted emails. The impact is limited to confidentiality: the CVSS vectors do not assign direct consequences to system integrity or availability.

Both vulnerabilities have a CVSS score of 5.9 and the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The attack complexity is high because a machine-in-the-middle position is required. However, no credentials or user interaction are necessary.

AsyncOS 16.5.0 and Earlier Versions Are Affected

The two flaws affect Cisco Secure Email appliances that meet both of the following conditions:

• they run Cisco AsyncOS 16.5.0 or earlier;
• S/MIME is configured for communications between email gateways.

The presence of a vulnerable release alone is therefore not sufficient: the S/MIME feature must be enabled for the specific gateway-to-gateway scenario. Administrators should verify both conditions during asset inventories rather than relying solely on the installed version.

Cisco recommends upgrading to the appropriate software version identified in the details for bugs CSCwu28362 and CSCwu28364. The exact fixed-release numbers were not provided in the available information, so no single valid build can be specified for every appliance.

No workaround completely eliminates the vulnerabilities. Before upgrading, administrators should check available memory, hardware compatibility, and whether the configuration will remain supported. If the appropriate release is not directly accessible, Cisco recommends contacting the Technical Assistance Center or the relevant maintenance provider.

Advisory cisco-sa-esa-smime-disc-dzw4rEdY, final version 1.0, was published at 16:00 GMT on September 2, 2026. A preliminary PSIRT notification had been issued at 16:00 GMT on August 26, 2026, and updated to final version 1.1 at 16:02 GMT on September 2, adding links to the complete advisories.

Cisco is aware of a public disclosure concerning the two vulnerabilities but has not observed malicious exploitation. The report is attributed to an external researcher whose name was not disclosed.

IOS XR: Seven CVEs and Remote Code Execution Risk

The Cisco IOS XR Software Security Hardening Release: September 2026 addresses seven vulnerabilities:

• CVE-2026-20277, CVSS 8.2;
• CVE-2026-20278, CVSS 8.8;
• CVE-2026-20280, CVSS 8.8;
• CVE-2026-20279, CVSS 9.8;
• CVE-2026-20276, CVSS 8.6;
• CVE-2026-20275, CVSS 8.8;
• CVE-2026-20274, for which an individual score is not available here.

The hardening release is classified overall as critical, with a maximum CVSS score of 9.8. The individual scores nevertheless show significant differences in prerequisites and impact.

CVE-2026-20279 is the most serious issue in the group. It can be exploited remotely, without authentication or user interaction, with a high impact on confidentiality, integrity, and availability. It is associated with memory-safety issues and improper access control.

CVE-2026-20274 involves memory-corruption conditions. Overall, Cisco warns that the IOS XR flaws could enable remote code execution and other forms of attack.

Exploitation of CVE-2026-20278 and CVE-2026-20280 requires low-level privileges. CVE-2026-20275 has an adjacent attack vector, meaning the attacker must be on a logically or physically nearby network. CVE-2026-20276 primarily affects availability, while CVE-2026-20277 could modify data and cause a high-impact service disruption.

The vulnerable IOS XR releases and fixed builds were not specified. No specific indicators of compromise are known that would allow operators to identify exploitation of the seven CVEs. Operators should therefore consult the advisory for their platform and install the appropriate software release provided by Cisco.

Nexus 9000: Compromise Could Lead to Root Privileges

Cisco Nexus 9000 Series switches, particularly models based on Silicon One, are affected by CVE-2026-20212, a critical vulnerability with a CVSS score of 9.8.

A remote attacker can connect to TCP ports that are accessible by default and execute code with root privileges. This level of access could result in full compromise of the switch, affecting managed traffic, configuration, and network availability.

The affected port numbers, vulnerable releases, and fixed builds were not disclosed. Administrators should identify Nexus 9000 devices in their infrastructure, determine whether they belong to the platforms listed in the advisory, and restrict access to management services wherever possible.

Because the port numbers are unavailable, no universal detection rule can be defined. It is still useful to analyze connections to TCP services normally exposed by the switch and look for unauthorized administrative changes, processes, or configuration modifications.

Continuous HTTP Packets Could Take Cisco Phones Offline

CVE-2026-20281 affects four families of endpoints running SIP software:

• Cisco Desk Phone 9800 Series;
• Cisco IP Phone 7800 Series;
• Cisco IP Phone 8800 Series;
• Cisco Video Phone 8875.

The vulnerability is high severity, with a CVSS score of 7.5. An unauthenticated remote attacker can send continuous streams of specially crafted HTTP packets, triggering a denial-of-service condition.

The impact is phone unavailability, which is particularly serious in environments that rely on VoIP for operations, support, or emergency communications. The vulnerable versions, fixed releases, and any specific temporary mitigations are not known.

Network teams should monitor for abnormal HTTP volumes directed at phones, repeated request sequences, and simultaneous reboots or connectivity losses. Segmenting VoIP endpoints and restricting access to their related services reduces the reachable attack surface but does not replace patching.

How to Prioritize Remediation

IOS XR and Nexus 9000 should take priority because of the potential for code execution, particularly when vulnerable services are reachable from untrusted networks. For Nexus devices, the possibility of root access further increases the impact.

Next, administrators should check Secure Email gateways running AsyncOS 16.5.0 or earlier. The vulnerabilities have been publicly disclosed and no workaround is available, although Cisco has not observed malicious exploitation of the two S/MIME CVEs.

SIP phones should be included in the same update cycle, together with HTTP traffic monitoring. A DoS attack distributed across many endpoints could disrupt an entire phone service.

It is not known whether these vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog; consequently, no associated federal deadline is available. For all platforms, the operational guidance remains to install the fixed releases published by Cisco in the respective advisories.