SEPPmail Secure Email Gateway CVE-2026-7864

The vulnerability requires the GINA UI component to be enabled and accessible from the attacker's network (no firewall or authentication layer blocking access to the vulnerable endpoint). The CVSS vector confirms unauthenticated, network-accessible exploitation: PR:N (no privilege required), UI:N (no user interaction), AC:L (default or common configuration). There are no special conditions such as specific product features being enabled, non-standard configurations, or user interaction-any SEPPmail Secure Email Gateway instance with GINA UI deployed and reachable over the network can be exploited. Exploitation is limited only by network connectivity to the affected system; organizations with the GINA UI behind firewalls, authentication gateways, or entirely air-gapped systems are not vulnerable.

This vulnerability presents moderate real-world risk driven by low exploitation barriers but limited direct impact. The CVSS 4.0 vector confirms AV:N (network-accessible), AC:L (low attack complexity), PR:N (no privileges required), UI:N (no user interaction), with VC:L (low confidentiality impact) and no impact to integrity or availability. The EPSS and KEV status are not provided, but the unauthenticated, low-complexity attack vector suggests this is likely automatable and could have high exploitation probability if the GINA UI is internet-facing. The primary risk is information disclosure-leaked environment variables can facilitate further attacks by revealing internal infrastructure, service accounts, or cryptographic material. However, this is not a code execution or authentication bypass; an attacker must still exploit the disclosed information. The real-world priority depends on deployment: organizations exposing SEPPmail to untrusted networks should treat this as urgent, while air-gapped or internal-only instances face lower risk. Key unknown: whether environment variables contain plaintext credentials or only non-secret configuration.

A remote attacker identifies a SEPPmail Secure Email Gateway instance on the internet and sends an unauthenticated HTTP request to the GINA UI endpoint. The server responds with environment variables, revealing database credentials, internal API endpoints, and configuration details. The attacker uses this information to enumerate further vulnerabilities, attempt database access, or craft targeted phishing attacks using legitimate-looking internal service names and IP addresses.