What is the CVSS score of CVE-2026-27443?

CVE-2026-27443 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Seppmail are affected by CVE-2026-27443?

SEPPmail Secure Email Gateway versions before 15.0.1 contain a vulnerability that allows attackers to manipulate email headers in S/MIME protected messages, potentially enabling email spoofing and…

How to fix or mitigate CVE-2026-27443?

Within 24 hours: Identify all SEPPmail Secure Email Gateway instances and document current versions in your environment. Within 7 days: Contact SEPPmail for patch availability and deployment timeline; implement email header validation logging to detect suspicious activity. Within 30 days: Deploy patched versions (15.0.1 or later) across all systems; conduct audit of email traffic logs for evidence of header manipulation attempts.

Seppmail CVE-2026-27443

HIGH

Improper Input Validation (CWE-20)

2026-03-04 vulnerability@ncsc.ch

Code Injection Seppmail

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.

AnalysisAI

SEPPmail Secure Email Gateway versions before 15.0.1 fail to properly validate S/MIME message headers, enabling attackers to forge or manipulate email headers and bypass trust mechanisms without authentication. This allows adversaries to spoof trusted senders or inject malicious headers into encrypted messages, potentially facilitating phishing and social engineering attacks. No patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Seppmail. SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.