Seppmail CVE-2026-29141

Remote unauthenticated attacker can send crafted emails to SEPPmail Secure Email Gateway versions before 15.0.3. The gateway processes emails without proper subject line sanitization, allowing forging of security tags like [signed OK]. No victim interaction required; exploitation occurs during email processing.

Without CVSS scoring data, real-world risk assessment relies on contextual factors: the vulnerability is a tag-forgery and header-injection class issue affecting an email security gateway-a high-value target because compromising its authentication indicators directly undermines downstream email security for all users behind it. The attack vector is remote (email-based), complexity is likely low (subject line injection), and no authentication is typically required to send external email. NCSC.ch's disclosure elevates visibility and credibility. The absence of CVSS scoring and EPSS data limits quantified risk ranking, but the nature of the flaw (authentication bypass via sanitization bypass) is strategically significant: a single compromised email can reach hundreds or thousands of recipients with forged trust signals. Organizations using SEPPmail should prioritize this as a medium-to-high priority based on their email threat model and user education gaps. The lack of confirmed active exploitation does not reduce priority-email spoofing attacks are typically cost-effective and don't require sophisticated tooling once the bypass mechanism is known.

An external attacker sends a phishing email with a forged subject line containing a [signed OK] tag or similar authentication indicator. The email passes through the unpatched SEPPmail Secure Email Gateway, which fails to properly sanitize or reject the forged tag because of the input validation flaw. An end user receives the email with the spoofed authentication signal, perceives it as legitimate, and clicks a malicious link or provides credentials to a fake login page. This attack is particularly effective because it exploits the user's trust in their own email security infrastructure rather than the email protocol itself. The simplicity and scalability of subject-line injection attacks makes this a practical threat even without specialized exploit code.