CVE-2026-29140
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In SEPPmail Secure Email Gateway before version 15.0.3, an attacker can cause attacker-controlled certificates to be used for future encryption to a victim by adding those certificates to S/MIME signatures. As a result, future communication may be encrypted with the attacker's key.
Risk Assessment
An attacker may intercept or decrypt the victim's future email correspondence, compromising communication confidentiality. The risk affects organizations running vulnerable SEPPmail gateway versions.
Recommendation
Upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later. Verify trust in certificates used in S/MIME signatures and monitor for unusual encryption configuration changes.
Other vulnerabilities in SEPPmail Secure Email Gateway
See all- CVE-2026-44127High
SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.
- CVE-2026-7864Medium
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.
- CVE-2026-44128Critical
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.
- CVE-2026-44126Critical
SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which may allow unauthenticated remote attackers to execute code via a crafted serialized object.
- CVE-2026-44125Critical
SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.
- CVE-2026-84832High
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges.
- CVE-2026-84831High
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
- CVE-2026-84830High
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
- CVE-2026-9592High
A vulnerability in SEPPmail Secure Email Gateway and SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay and hijack a user session in the GINA web portal. The session token is disclosed inside the URL and an HTTP header.
- CVE-2026-44129High
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI. An attacker can upload a controlled template, allowing for the execution of arbitrary template expressions and potentially achieving remote code execution depending on the enabled template plugins.
Original NVD description (English source)
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS