Is there a patch available for CVE-2026-29132?

Yes, a patch is available for CVE-2026-29132. Update the affected software to the latest version immediately.

Secure Email Gateway CVE-2026-29132

Q: What is the CVSS score of CVE-2026-29132?

CVE-2026-29132 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18144 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-02 NCSC.ch

GHSA-7w6x-34cj-2vph

Authentication Bypass Secure Email Gateway

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 08:45 euvd

EUVD-2026-18144

Analysis Generated

Apr 02, 2026 - 08:45 vuln.today

CVE Published

Apr 02, 2026 - 08:25 nvd

MEDIUM 6.3

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protected emails.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 allows authenticated attackers with access to a victim's GINA account to bypass secondary password verification and directly access protected emails, circumventing a multi-factor authentication mechanism intended to protect sensitive correspondence.

Technical ContextAI

SEPPmail Secure Email Gateway implements a GINA (Generic Internet Naming Architecture) account system with a secondary password check as a defense-in-depth control for accessing encrypted or protected emails. The vulnerability stems from insufficient authentication validation (CWE-306: Missing Authentication for Critical Function), allowing an attacker who has compromised or obtained access to a victim's primary GINA credentials to skip or bypass the secondary password prompt entirely. This breaks the intended two-factor authentication workflow and exposes the confidentiality of protected email messages. The affected product is the SEPPmail Secure Email Gateway suite across all versions prior to 15.0.3, as indicated by the CPE string specifying all versions (indicated by the wildcard) below the fixed version.

RemediationAI

Organizations must upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later to remediate this vulnerability. The vendor has released patched version 15.0.3, which includes a fix for the secondary password bypass. Administrators should follow the standard SEPPmail update procedures, test the patched version in a non-production environment if possible, and schedule a maintenance window to deploy the update. Detailed upgrade instructions and release notes are available in the SEPPmail Secure Email Gateway version 15.0.3 release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503. Until patching is completed, organizations should monitor GINA account access logs for unauthorized login attempts and consider implementing additional access controls or temporary restrictions on sensitive user accounts.