SEPPmail CVE-2026-9592

Exploitation requires the victim to use the GINA web portal of a SEPPmail deployment older than 15.0.4.2, and the attacker to be able to observe the session token that the portal places in the request URL and an HTTP header - via the adjacent network (AV:A), an on-path proxy, a shared web/proxy access log, or a leaked Referer header. No authentication and no user interaction are needed to replay the captured token (PR:N/UI:N/AT:N). The principal limiting factor is the Adjacent attack vector: the attacker must be positioned in the traffic/log path rather than exploiting the gateway directly over the internet, and the token must still be valid when replayed.

The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) rates this 7.5 High, but the Adjacent (AV:A) attack vector is the key limiter: an attacker must be positioned in the traffic path - same network segment, an intermediary proxy, or a system that receives leaked Referer/log data - rather than exploiting it directly across the open internet. Privileges are none (PR:N) and no attack requirements or user interaction are needed (AT:N/UI:N), so once positioned, capturing and replaying the token is low-complexity (AC:L). The exploit-maturity metric is E:U (Unproven), consistent with no public exploit identified at time of analysis; there is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of active exploitation. Net assessment: a credible, real confidentiality/integrity risk for organizations relying on GINA for sensitive mail, but the adjacent-network requirement makes opportunistic mass exploitation unlikely - prioritize patching where GINA is internet-adjacent or traverses shared/untrusted networks.

An attacker on the same network segment as a GINA user, or with access to an intermediary proxy or web-server log, captures the session token embedded in the portal URL or HTTP header. They replay that token to hijack the victim's authenticated GINA session and read the victim's encrypted messages or act as the victim. No public exploit is identified at time of analysis, and the adjacent-network requirement (AV:A) means the attacker must already be positioned in the traffic path.