What is the CVSS score of CVE-2026-2747?

CVE-2026-2747 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Seppmail are affected by CVE-2026-2747?

SEPPmail Secure Email Gateway instances before version 15.0.1 fail to properly isolate decrypted PGP messages, potentially exposing sensitive information to unauthorized actors.

How to fix or mitigate CVE-2026-2747?

Within 24 hours: Identify all SEPPmail deployments and confirm version numbers; notify business stakeholders of potential exposure risk. Within 7 days: Implement network segmentation to restrict gateway access, disable inline PGP decryption if operationally feasible, and monitor email logs for suspicious access patterns. Within 30 days: Establish patch management timeline with vendor, test version 15.0.1 or later in staging environment, and prepare deployment schedule for production systems.

Seppmail CVE-2026-2747

HIGH

Information Exposure (CWE-200)

2026-03-04 vulnerability@ncsc.ch

Information Disclosure Seppmail

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure of sensitive information to an unauthorized actor.

AnalysisAI

SEPPmail Secure Email Gateway versions prior to 15.0.1 fail to properly isolate decrypted PGP message content from surrounding plaintext, enabling attackers to access encrypted sensitive information over the network without authentication. This high-severity flaw affects organizations relying on SEPPmail for secure email handling and exposes confidential data despite encryption protections. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Seppmail. SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure of sensitive information to an unauthorized actor.