CVE-2025-20153 [Medium] | Security Bypass in Secure Email Gateway

A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules and allow emails that should have been denied to flow through an affected device.   This vulnerability is due to improper handling of email that passes through an affected device. An attacker could exploit this vulnerability by sending a crafted email through the affected device. A successful exploit could allow the attacker to bypass email filters on the affected device.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-04-06	0.25%	0.13%	-0.12%
2	2026-03-30	0.07%	0.25%	+0.18%
3	2025-09-25	—	0.07%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-04-06

0.25%

0.13%

-0.12%

2026-03-30

0.07%

0.25%

+0.18%

2025-09-25

—

0.07%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.8	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	3.9	1.4	[email protected]
5.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	3.9	1.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.8

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

3.9

1.4

[email protected]

5.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

3.9

1.4

[email protected]

Affected software / configurations for CVE-2025-20153

Vendor	Product	Version	Raw CPE
cisco	secure_email_gateway	13.0.0-392	cpe:2.3:a:cisco:secure_email_gateway:13.0.0-392:::::::*
cisco	secure_email_gateway	13.0.5-007	cpe:2.3:a:cisco:secure_email_gateway:13.0.5-007:::::::*
cisco	secure_email_gateway	13.5.1-277	cpe:2.3:a:cisco:secure_email_gateway:13.5.1-277:::::::*
cisco	secure_email_gateway	13.5.4-038	cpe:2.3:a:cisco:secure_email_gateway:13.5.4-038:::::::*
cisco	secure_email_gateway	14.0.0-698	cpe:2.3:a:cisco:secure_email_gateway:14.0.0-698:::::::*
cisco	secure_email_gateway	14.2.0-620	cpe:2.3:a:cisco:secure_email_gateway:14.2.0-620:::::::*
cisco	secure_email_gateway	14.2.1-020	cpe:2.3:a:cisco:secure_email_gateway:14.2.1-020:::::::*
cisco	secure_email_gateway	14.3.0-032	cpe:2.3:a:cisco:secure_email_gateway:14.3.0-032:::::::*
cisco	secure_email_gateway	15.0.0-104	cpe:2.3:a:cisco:secure_email_gateway:15.0.0-104:::::::*
cisco	secure_email_gateway	15.0.1-030	cpe:2.3:a:cisco:secure_email_gateway:15.0.1-030:::::::*
cisco	secure_email_gateway	15.0.3-002	cpe:2.3:a:cisco:secure_email_gateway:15.0.3-002:::::::*
cisco	secure_email_gateway	15.5.0-048	cpe:2.3:a:cisco:secure_email_gateway:15.5.0-048:::::::*
cisco	secure_email_gateway	15.5.1-055	cpe:2.3:a:cisco:secure_email_gateway:15.5.1-055:::::::*
cisco	secure_email_gateway	15.5.2-018	cpe:2.3:a:cisco:secure_email_gateway:15.5.2-018:::::::*
cisco	secure_email_gateway	16.0.0-050	cpe:2.3:a:cisco:secure_email_gateway:16.0.0-050:::::::*

References for CVE-2025-20153

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-mailpol-bypass-5nVcJZMw	Vendor Advisory

URL

CVE-2025-20153 | Cisco ESA mail Bypass

Exploit prediction scoring system (EPSS) score for CVE-2025-20153

Common vulnerability scoring system (CVSS) metrics for CVE-2025-20153

Weakness enumeration for CVE-2025-20153

Affected software / configurations for CVE-2025-20153

References for CVE-2025-20153