Seppmail CVE-2026-29131

Although CVSS and EPSS scores are not provided, the vulnerability carries significant real-world risk based on available signals. The attack vector is network-based (remote email submission), requires no authentication, and results in complete confidentiality breach of encrypted email contents-the core security function of the product. The practical exploitation requirement is low (crafting a malformed email address), and no CVSS complexity penalties appear justified given LDAP injection patterns are well-understood. The fact that NCSC.ch (Swiss National Cybersecurity Centre) reported this and a vendor patch exists in version 15.0.3 suggests this is a confirmed, credible vulnerability with real defensive response. Absent CVSS/EPSS data, this should be treated as a high-priority information disclosure affecting the fundamental trust model of encrypted email systems.

An attacker sends an email to a targeted SEPPmail gateway with a specially crafted recipient email address containing LDAP injection syntax (e.g., wildcard or filter manipulation characters). The gateway's LDAP recipient validation fails to sanitize the input, allowing the attacker's query to bypass intended recipient restrictions and return encryption keys or decrypted content for emails originally encrypted for legitimate users. This could be automated to enumerate multiple recipient addresses and extract sensitive communications at scale. No public exploit code has been confirmed at the time of this analysis, but the exploitation complexity is low given the straightforward nature of LDAP injection techniques.