Which versions of SEPPmail are affected by CVE-2026-9592?

SEPPmail Secure Email Gateway and Cloud versions below 15.0.4.2 are vulnerable to session hijacking through token exposure in URL parameters, risking unauthorized account takeover of the…

How to fix or mitigate CVE-2026-9592?

Within 24 hours, audit your infrastructure to identify all SEPPmail deployments and confirm whether any instances run versions prior to 15.0.4.2; isolate affected systems from the network perimeter if feasible and document findings. Within 7 days, implement compensating controls by configuring proxies and WAF rules to strip session tokens from URLs before logging, disabling URL-based session transmission where configuration permits, and establishing real-time alerts for authentication anomalies on the GINA portal. Within 30 days, work with SEPPmail to obtain a patch timeline; request an update on 15.0.4.2 availability and evaluate temporary email gateway failover options if service interruption is acceptable, then plan for staged upgrade as soon as a vendor-released patch is confirmed.

SEPPmail CVE-2026-9592

Q: What is the CVSS score of CVE-2026-9592?

CVE-2026-9592 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45174 HIGH

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-07-17 NCSC.ch

GHSA-2rg6-hxw2-6rh8

Information Disclosure Seppmail Secure Email Gateway Seppmail Cloud

7.5

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

7.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Token disclosure is exploitable by an on-path/adjacent attacker (AV:A) with no auth or interaction (PR:N/UI:N); session hijack yields high confidentiality and integrity impact, no availability effect (A:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 14:30 vuln.today

CVE Published

Jul 17, 2026 - 13:51 cve.org

HIGH 7.5

DescriptionCVE.org

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.

AnalysisAI

Session hijacking in SEPPmail Secure Email Gateway and SEPPmail Cloud before 15.0.4.2 lets an attacker who can observe traffic replay a victim's GINA web portal session because the session token is exposed both in the URL and in an HTTP header. Because the token travels in the request URL, it can leak into proxy logs, browser history, and Referer headers, enabling account takeover of the secure-message portal. There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is 'Unproven' (E:U); the vendor CVSS 4.0 base score is 7.5.

Technical ContextAI

SEPPmail is an email encryption/secure-messaging gateway; its GINA (Guided Interactive Nomadic Access) web portal is the browser interface external recipients use to read encrypted messages without their own S/MIME or PGP keys. The flaw is classified as CWE-598 (Use of GET Request Method With Sensitive Query Strings), meaning a sensitive session token is placed in the request URL - and additionally in an HTTP header - rather than in a properly scoped, non-loggable cookie. Tokens carried in URLs are persisted in web-server and proxy access logs, browser history, bookmarks, and are transmitted in the Referer header to third-party resources, so the secret is disclosed to any party in that data path. The affected CPE is cpe:2.3:a:seppmail:seppmail_secure_email_gateway_&_seppmail_cloud, covering both the on-premise gateway and the hosted cloud offering.

RemediationAI

Vendor-released patch: upgrade to SEPPmail 15.0.4.2 or later, which per the release notes removes the login redirect that disclosed the session token; SEPPmail Cloud tenants are updated by the vendor. See https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#remove-login-redirect-to-prevent-disclosure-of-session-token-information. Until the upgrade is applied, reduce token leakage by placing GINA behind a reverse proxy that strips session tokens from access logs and suppresses the Referer header on outbound links, restricting network reach to the GINA portal so untrusted adjacent hosts cannot observe traffic, enforcing HTTPS end-to-end to prevent on-path sniffing, and rotating/invalidating existing GINA sessions after upgrade; note these are stopgaps that do not remove the token from the URL itself and can break deployments that rely on the redirect behavior.