Is there a patch available for CVE-2026-29142?

Yes, a patch is available for CVE-2026-29142. Update the affected software to the latest version immediately.

Secure Email Gateway CVE-2026-29142

Q: What is the CVSS score of CVE-2026-29142?

CVE-2026-29142 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18165 MEDIUM

Missing Cryptographic Step (CWE-325)

2026-04-02 NCSC.ch

Information Disclosure Secure Email Gateway

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 09:00 euvd

EUVD-2026-18165

Analysis Generated

Apr 02, 2026 - 09:00 vuln.today

CVE Published

Apr 02, 2026 - 08:44 nvd

MEDIUM 6.3

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers to forge GINA-encrypted emails, compromising email authenticity and potentially enabling spoofing attacks. The vulnerability affects all versions prior to 15.0.3 and was reported by NCSC.ch. No CVSS score is available, and exploitation status has not been independently confirmed at time of analysis.

Technical ContextAI

The vulnerability involves improper cryptographic implementation in the GINA (email encryption/authentication mechanism) used by SEPPmail Secure Email Gateway. CWE-325 (Incorrect Regular Expression) suggests the root cause may involve validation logic flaws in how encrypted email authenticity is verified or enforced. GINA-encrypted emails are intended to provide integrity and authenticity guarantees; this vulnerability breaks that promise by allowing attackers to construct forged messages that pass validation checks. The affected product is identified by CPE cpe:2.3:a:seppmail:secure_email_gateway:*:*:*:*:*:*:*:*, indicating the vulnerability affects the entire Secure Email Gateway product line across all versions before the fixed release.

RemediationAI

Upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later. This is the vendor-released patch that resolves the GINA email forging vulnerability. Organizations should consult the official release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503 for deployment guidance and any additional mitigation steps. Until patching is completed, network-level controls to restrict unauthorized email gateway communications may provide temporary risk reduction, though patching remains the primary remediation path.