Which versions of Seppmail are affected by CVE-2026-29139?

SEPPmail Secure Email Gateway versions prior to 15.0.3 contain an account takeover vulnerability that allows unauthenticated attackers to reset user passwords and gain unauthorized access to…. A patch is available.

How to fix or mitigate CVE-2026-29139?

Within 24 hours: Identify all SEPPmail Secure Email Gateway instances and document current versions. Within 7 days: Apply vendor patch to upgrade all affected systems to version 15.0.3 or later; test in non-production environment first. Within 30 days: Conduct account audit to identify any unauthorized password resets or mailbox access occurring post-deployment; implement enhanced monitoring on authentication and account modification events.

Seppmail CVE-2026-29139

Q: What is the CVSS score of CVE-2026-29139?

CVE-2026-29139 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18158 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-02 NCSC.ch

Information Disclosure Seppmail Secure Email Gateway

7.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 19:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 09:00 euvd

EUVD-2026-18158

Analysis Generated

Apr 02, 2026 - 09:00 vuln.today

CVE Published

Apr 02, 2026 - 08:52 nvd

HIGH 7.8

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.

AnalysisAI

Account takeover in SEPPmail Secure Email Gateway versions before 15.0.3 allows unauthenticated attackers to reset victim account passwords by abusing GINA account initialization functionality, enabling full mailbox compromise without requiring legitimate credentials or administrative access.

Technical ContextAI

SEPPmail Secure Email Gateway's GINA (likely a user account provisioning or management module) contains a flaw in its account initialization logic classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The vulnerability permits password reset operations to be invoked outside the normal authentication pathway, allowing attackers to bypass credential verification and assume control of existing user accounts. This represents a critical break in the authentication model where account initialization routines are not properly gated to authorized administrators or are accessible through an alternate unauthenticated vector.

RemediationAI

Upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later immediately. This version contains the fix for the GINA account initialization flaw. Organizations unable to upgrade immediately should restrict network access to the gateway's administration interfaces and monitor account modification logs for unauthorized password reset activity. Refer to the official vendor release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503 for complete remediation and detailed technical changes.