Seppmail CVE-2026-29137

Despite the absence of a CVSS score in the input data, the vulnerability carries moderate real-world risk. The attack vector is remote and requires no authentication (attacker sends email), with low complexity (simply crafting a long subject line), resulting in low technical impact (information disclosure of security metadata rather than data exfiltration or code execution). However, the practical impact is significant: security tags are a critical last-mile defense against phishing and social engineering. By hiding these tags, attackers can increase success rates of spear-phishing campaigns targeting enterprise users, particularly in environments where security-conscious employees rely on gateway indicators. The lack of CVSS and EPSS data prevents quantitative comparison, but this is functionally a medium-priority issue: not as severe as RCE or authentication bypass, but more serious than minor information leaks because it directly undermines user security decision-making. No KEV status or POC availability is reported, suggesting limited active exploitation at time of analysis.

An attacker crafts a phishing email with a legitimately formatted From: header (spoofing a trusted sender) but includes an extremely long Subject: line (e.g., 500+ characters of padding text). The email is sent to a target user whose organization uses SEPPmail Gateway. Upon delivery, the gateway processes the email but fails to render the expected security tag (e.g., 'PHISHING RISK' or 'EXTERNAL') due to the subject line length triggering the rendering bypass. The user receives the email in their inbox without any visual indicator that it is suspicious, increasing the likelihood they will click a malicious link or credential-theft attachment. The attacker gains access to the user's account or systems without the security tag having alerted the user to the email's untrusted nature.