CVE-2026-20353

Cisco Secure Email Gateway Security Hardening Release

State: Published
Severity: 9.8 Critical
Published: Sep 14, 2026
Updated: Sep 15, 2026
Reserved: Oct 8, 2025

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-664 Improper Control of a Resource Through its Lifetime

Affected Products

Product	Versions
Cisco Secure EmailCisco	14.0.0-698Affected 13.5.1-277Affected 13.0.0-392Affected 14.2.0-620Affected 13.0.5-007Affected 13.5.4-038Affected 14.2.1-020Affected 14.3.0-032Affected 15.0.0-104Affected 15.0.1-030Affected 15.5.0-048Affected 15.5.1-055Affected 15.5.2-018Affected 16.0.0-050Affected 15.0.3-002Affected 16.0.0-054Affected 15.5.3-022Affected 16.0.1-017Affected 15.5.4-012Affected 16.0.4-016Affected 15.0.5-016Affected 16.0.2-112Affected 16.0.3-044Affected

Product

Versions

Cisco Secure EmailCisco

14.0.0-698Affected
13.5.1-277Affected
13.0.0-392Affected
14.2.0-620Affected
13.0.5-007Affected
13.5.4-038Affected
14.2.1-020Affected
14.3.0-032Affected
15.0.0-104Affected
15.0.1-030Affected
15.5.0-048Affected
15.5.1-055Affected
15.5.2-018Affected
16.0.0-050Affected
15.0.3-002Affected
16.0.0-054Affected
15.5.3-022Affected
16.0.1-017Affected
15.5.4-012Affected
16.0.4-016Affected
15.0.5-016Affected
16.0.2-112Affected
16.0.3-044Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.