EUVD-2026-70363
GHSA-4fw6-qxc4-gqgq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but requires valid credentials (PR:L) and a specific transient account state (pre-enrollment), justifying AC:H; full privileged session granted on success yields C:H/I:H/A:H.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
3DescriptionCVE.org
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
AnalysisAI
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be met: (1) the attacker must possess valid credentials (username and password) for a target account - PR:L in the CVSS vector confirms credential knowledge is required; (2) the target account must be configured as MFA-required but must not yet have completed MFA enrollment (the 'unenrolled' state). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H correctly captures the key tension: full system-level impact (C:H/I:H/A:H) but gated behind two non-trivial prerequisites - valid credentials (PR:L) and an account in the pre-enrollment window (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SEPPmail SEG to version 15.0.7 or later, which is confirmed by the vendor release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html as the fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, contact SEPPmail support to determine if your deployment runs SEG versions prior to 15.0.7 and identify all user accounts with assigned credentials but incomplete MFA enrollment status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today