SecurityWeek (3 September 2026) summarises Cisco’s 2 September advisory drop. Two medium-severity, publicly disclosed but unpatched issues in Secure Email S/MIME decryption — CVE-2026-20354 and CVE-2026-20355 — can let a MitM attacker obtain plaintext from encrypted gateway traffic; Cisco says that at the time of publication the flaws affected Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME configured for communication between email gateways, and that it is not aware of any malicious use (Cisco CVSS 5.9 for each).

The same day Cisco also shipped critical fixes for IOS XR (including CVE-2026-20274 and CVE-2026-20279 at CVSS 9.8 for memory-corruption / improper access-control classes) and Nexus 9000 series switches (CVE-2026-20212, CVSS 9.8: remote code execution with root via by-default accessible TCP ports), plus high-severity SIP phone DoS CVE-2026-20281 on Desk Phone 9800 / IP Phone 7800/8800 / Video Phone 8875.

Primary vendor notice: cisco-sa-esa-smime-disc-dzw4rEdY and the 2 Sep publication notice. Apply available IOS XR / Nexus / phone patches; for Secure Email, Cisco says there are no workarounds; check the fixed releases listed in Cisco bug IDs CSCwu28362 and CSCwu28364, which the advisory points to.

Correction (25 Oct 2026): Cisco's advisory (version 1.1, updated 8 September) says there are no workarounds for CVE-2026-20354 and CVE-2026-20355 and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases; the earlier advice to apply workarounds from the advisory was wrong and has been removed. (source: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY)