Read the docs
TI-2025-14453 Aliases CVE-2025-20153GHSA-9ppw-7p8w-h9g2

Cisco ESA mail Bypass

Priority LOW 32CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that should have been denied to flow through an affected device.   This vulnerability is due to improper handling of email that passes through an affected device. An attacker could exploit this vulnerability by sending a crafted email through the affected device. A successful exploit could allow the attacker to bypass email filters on the affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Email14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002—No fix listedCNA
  • Cisco Secure Email VendorCisco Affected 14.0.0-698; 13.5.1-277; 13.0.0-392; 14.2.0-620; 13.0.5-007; 13.5.4-038; 14.2.1-020; 14.3.0-032; 15.0.0-104; 15.0.1-030; 15.5.0-048; 15.5.1-055; 15.5.2-018; 16.0.0-050; 15.0.3-002 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_email_gateway:13.0.0-392:*:*:*:*:*:*:*13.0.0-392VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:13.0.5-007:*:*:*:*:*:*:*13.0.5-007VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:13.5.1-277:*:*:*:*:*:*:*13.5.1-277VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:13.5.4-038:*:*:*:*:*:*:*13.5.4-038VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:14.0.0-698:*:*:*:*:*:*:*14.0.0-698VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:14.2.0-620:*:*:*:*:*:*:*14.2.0-620VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:14.2.1-020:*:*:*:*:*:*:*14.2.1-020VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:14.3.0-032:*:*:*:*:*:*:*14.3.0-032VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:15.0.0-104:*:*:*:*:*:*:*15.0.0-104VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:15.0.1-030:*:*:*:*:*:*:*15.0.1-030VulnerableCisco
  • cpe:2.3:a:cisco:secure_email_gateway:13.0.0-392:*:*:*:*:*:*:* Versions 13.0.0-392 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:13.0.5-007:*:*:*:*:*:*:* Versions 13.0.5-007 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:13.5.1-277:*:*:*:*:*:*:* Versions 13.5.1-277 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:13.5.4-038:*:*:*:*:*:*:* Versions 13.5.4-038 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:14.0.0-698:*:*:*:*:*:*:* Versions 14.0.0-698 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:14.2.0-620:*:*:*:*:*:*:* Versions 14.2.0-620 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:14.2.1-020:*:*:*:*:*:*:* Versions 14.2.1-020 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:14.3.0-032:*:*:*:*:*:*:* Versions 14.3.0-032 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.0.0-104:*:*:*:*:*:*:* Versions 15.0.0-104 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.0.1-030:*:*:*:*:*:*:* Versions 15.0.1-030 Vulnerable ·Cisco
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:secure_email_gateway:15.0.3-002:*:*:*:*:*:*:*15.0.3-002VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:15.5.0-048:*:*:*:*:*:*:*15.5.0-048VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:15.5.1-055:*:*:*:*:*:*:*15.5.1-055VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:15.5.2-018:*:*:*:*:*:*:*15.5.2-018VulnerableCisco
cpe:2.3:a:cisco:secure_email_gateway:16.0.0-050:*:*:*:*:*:*:*16.0.0-050VulnerableCisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.0.3-002:*:*:*:*:*:*:* Versions 15.0.3-002 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.5.0-048:*:*:*:*:*:*:* Versions 15.5.0-048 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.5.1-055:*:*:*:*:*:*:* Versions 15.5.1-055 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:15.5.2-018:*:*:*:*:*:*:* Versions 15.5.2-018 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_email_gateway:16.0.0-050:*:*:*:*:*:*:* Versions 16.0.0-050 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-20153
  2. 2026-10-03 Alias added: GHSA-9ppw-7p8w-h9g2

References

Advisory 1

  • TI-2024-13334 A vulnerability in the content scanning and message filtering features of Cisco Secure… CVSS 3.1CRITICAL 9.8
  • TI-2023-06827 Cross-site scripting in Cisco Web Security Appliance CVSS 3.1MEDIUM 6.1
  • TI-2023-06826 Cross-site scripting in Cisco Secure Email and Web Manager CVSS 3.1MEDIUM 6.1
  • TI-2023-06737 Cross-site scripting in Cisco Web Security Appliance CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences