Seppmail CVE-2026-29142

Without a CVSS vector or EPSS score, quantitative risk assessment is limited. However, the core impact-ability to forge encrypted emails-is severe from an authenticity and trust perspective. The attack vector is likely network-based (remote attackers can send forged messages), and complexity is probably low once an attacker understands the cryptographic weakness. The vulnerability was reported by a national cybersecurity authority (NCSC.ch), indicating official recognition of the issue. The involvement of email authentication is high-impact for organizations relying on SEPPmail for secure communications, as forged emails could deceive recipients into trusting malicious content. No KEV status or public exploit code has been identified in the available data, suggesting this is a disclosed but not yet widely weaponized issue. Organizations using SEPPmail should prioritize patching based on email criticality rather than waiting for active exploitation signals.

An attacker crafts a GINA-encrypted email that appears to originate from a trusted internal sender or external partner by exploiting the cryptographic validation weakness. The forged email bypasses authenticity checks in the gateway, reaches the recipient with full encryption indicators and sender spoofing intact, and deceives the recipient into trusting its contents or following embedded instructions. This is particularly effective in targeted spear-phishing or business email compromise (BEC) scenarios where legitimate encryption signals are used to overcome skepticism.