What is the CVSS score of CVE-2026-27444?

CVE-2026-27444 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Seppmail are affected by CVE-2026-27444?

CVE-2026-27444 affects SEPPmail Secure Email Gateway installations and allows attackers to spoof email senders or decrypt messages by exploiting email header interpretation flaws.

How to fix or mitigate CVE-2026-27444?

Within 24 hours: Identify all SEPPmail Secure Email Gateway deployments and their versions; notify security and email operations teams; assess current version against 15.0.1 threshold. Within 7 days: Implement compensating controls (see below); document all affected systems; establish daily monitoring for suspicious email authentication anomalies. Within 30 days: Contact SEPPmail for patch availability and deployment timeline; conduct email security architecture review; consider vendor alternative assessment if patches remain unavailable.

Seppmail CVE-2026-27444

HIGH

Interpretation Conflict (CWE-436)

2026-03-04 vulnerability@ncsc.ch

Information Disclosure Seppmail

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.

AnalysisAI

SEPPmail Secure Email Gateway versions before 15.0.1 misinterpret email addresses in message headers, enabling attackers to spoof sender identities or decrypt encrypted communications due to inconsistent header parsing with standard mail infrastructure. This unauthenticated network-based vulnerability affects all default installations with no available patch, presenting significant risk to organizations relying on the gateway for email security.

Technical ContextAI

Classified as CWE-436 (Interpretation Conflict). Affects Seppmail. SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.