Seppmail EUVD-2026-18144

While CVSS and EPSS scores are unavailable, the vulnerability presents moderate-to-high real-world risk based on multiple risk signals. The attack requires prior compromise of the victim's GINA account (authenticated access), which moderates the overall attack surface but is still achievable through credential theft, phishing, or insider threats. The impact is high-direct confidentiality breach of protected emails-and the authentication bypass fundamentally undermines the security posture of the email gateway. CWE-306 (Missing Authentication for Critical Function) is a well-understood root cause often associated with authentication logic flaws. The NCSC.ch reporting attribution suggests this was identified through formal security review rather than active exploitation telemetry, and no public exploit code or KEV status has been indicated. Organizations running SEPPmail should prioritize patching, especially those processing sensitive or regulated email (healthcare, legal, financial) where email confidentiality is a compliance requirement.

An attacker obtains a victim's GINA credentials through phishing or credential stuffing, then logs into the SEPPmail Secure Email Gateway web portal. Normally, accessing protected or encrypted emails would trigger a secondary password prompt; however, due to the authentication bypass flaw, the attacker is able to directly read the victim's protected emails without providing the secondary password. This allows the attacker to exfiltrate confidential business communications, personal financial information, or other sensitive messages protected by the two-factor authentication mechanism. No public exploit code has been identified, but the vulnerability is straightforward to trigger once primary credentials are compromised.