Seppmail CVE-2026-29136

While no CVSS vector or CVSS score was provided, the vulnerability is classified as XSS (CWE-79) affecting email notifications, which typically carries moderate to high risk in enterprise email gateway contexts. The lack of CVSS data and EPSS score limits quantitative risk assessment, but the NCSC.ch reporting (Swiss national cybersecurity center) indicates this met disclosure standards for a known vulnerability. The attack vector appears to be remote without authentication requirements (notification emails are sent automatically), but the practical impact depends on an attacker's ability to trigger certificate notifications-this may require some level of system access or knowledge of gateway operations. The primary concern is that email gateways are high-value targets; XSS in notification emails could be leveraged to compromise administrator credentials or further infiltrate enterprise email infrastructure. This is not a critical remote code execution or authentication bypass, but it represents a real security gap in a sensitive product category. Real-world risk is elevated because email administrators and security personnel are likely to click links in gateway notifications, making social engineering follow-up attacks viable.

An attacker with knowledge of the SEPPmail deployment crafts a malicious CA certificate or triggers a certificate import process that causes the gateway to generate a CA certificate notification email containing injected HTML and JavaScript. When a gateway administrator or security team member opens the notification email to review the new certificate, the injected script executes in their email client or webmail interface, stealing session cookies or redirecting them to a phishing page that harvests credentials. The attacker could then use compromised administrative credentials to access the gateway's management interface or intercept encrypted emails, depending on the scope of administrator privileges. No public exploit code has been identified, but the attack requires only knowledge of the notification email workflow and the ability to interact with certificate management-a realistic scenario in post-compromise or insider threat scenarios.