SEPPmail SEG CVE-2026-84831

Two specific conditions must both be met: (1) the attacker must possess valid credentials (username and password) for a target account - PR:L in the CVSS vector confirms credential knowledge is required; (2) the target account must be configured as MFA-required but must not yet have completed MFA enrollment (the 'unenrolled' state). This second condition is transient and most prevalent during initial MFA rollout across an organization or when new user accounts are being provisioned. Exploitation is limited to network-accessible (AV:N) login interfaces of the SEG; no special network position is required. The attack does not work against accounts that have already completed MFA enrollment, nor against accounts not yet flagged as requiring MFA.

The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H correctly captures the key tension: full system-level impact (C:H/I:H/A:H) but gated behind two non-trivial prerequisites - valid credentials (PR:L) and an account in the pre-enrollment window (AT:P). In practice, the vulnerable account state is a transient condition that exists during MFA rollout or new-user onboarding, limiting the attack surface to accounts actively being provisioned. The risk is elevated in environments currently migrating from password-only to MFA, where many accounts could be in this transitional state simultaneously. No public exploit code or active exploitation (CISA KEV) has been identified, keeping real-world exploitation probability lower than the impact scores suggest. The EPSS score is not provided. Reporting by NCSC.ch indicates coordinated disclosure with a known national cybersecurity authority, lending credibility to the vulnerability.

An attacker who has obtained the password for a newly provisioned SEPPmail SEG account - through credential stuffing, phishing, or insider knowledge - checks whether the account is in the MFA enrollment-pending state. By initiating a login with only the password, the gateway erroneously creates a fully privileged session without prompting for or validating a second factor, granting the attacker complete access to email gateway functionality including encrypted message flows, gateway configuration, and user management. No public exploit code exists, but the attack requires only standard HTTP/web authentication tooling.