Which versions of Secure Email Gateway are affected by CVE-2026-29140?

SEPPmail Secure Email Gateway versions before 15.0.3 contain a certificate injection vulnerability in S/MIME signature processing that allows remote attackers to substitute attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-29140?

Within 24 hours: Identify all SEPPmail Secure Email Gateway instances and confirm current versions. Within 7 days: Apply vendor patch to version 15.0.3 or later across all SEPPmail deployments; test in non-production environment first. Within 30 days: Audit S/MIME certificate stores and signature validation logs for indicators of unauthorized certificate injection; implement enhanced monitoring for anomalous certificate usage in encrypted communications.

Secure Email Gateway CVE-2026-29140

Q: What is the CVSS score of CVE-2026-29140?

CVE-2026-29140 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18160 HIGH

Improper Certificate Validation (CWE-295)

2026-04-02 NCSC.ch

GHSA-mmr3-c33j-h2f2

Information Disclosure Secure Email Gateway

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 19:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 08:45 euvd

EUVD-2026-18160

Analysis Generated

Apr 02, 2026 - 08:45 vuln.today

CVE Published

Apr 02, 2026 - 08:27 nvd

HIGH 7.7

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 allows remote attackers to inject malicious certificates into S/MIME signatures, enabling them to substitute attacker-controlled certificates for future encryption communications with victims. An attacker can exploit this by crafting a specially-formed signed email that embeds unauthorized certificates, which the gateway may then use for subsequent encrypted messages to the targeted recipient, resulting in compromise of encryption confidentiality. No public exploit code or active CISA KEV listing is currently confirmed, but the vulnerability was reported by Swiss national security authority NCSC.ch.

Technical ContextAI

S/MIME (Secure/Multipurpose Internet Mail Extensions) uses digital certificates to sign and encrypt email messages. The vulnerability stems from improper validation of certificates embedded within S/MIME signatures (CWE-295: Improper Certificate Validation). When SEPPmail processes a signed email, it extracts certificates from the signature block to facilitate future encrypted replies. An attacker can craft a malicious S/MIME signature containing their own certificate, which the gateway accepts and stores without proper verification that the certificate legitimately belongs to the claimed sender or that it should be trusted for encryption. The gateway then uses this attacker-supplied certificate for subsequent encryption operations, allowing the attacker to decrypt future communications. The affected product is SEPPmail Secure Email Gateway across all versions before 15.0.3 (CPE: cpe:2.3:a:seppmail:secure_email_gateway:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: SEPPmail Secure Email Gateway version 15.0.3 and later. Administrators must immediately upgrade all affected SEPPmail deployments to version 15.0.3 or newer. No interim workarounds are documented; complete patching is the only confirmed mitigation. Organizations unable to patch immediately should consult SEPPmail technical support and the official advisory at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503 for temporary risk reduction strategies. After patching, administrators should consider audit procedures to verify whether untrusted certificates were injected into existing S/MIME signatures prior to upgrade.