Is there a patch available for EUVD-2026-18146?

Yes, a patch is available for EUVD-2026-18146. Update the affected software to the latest version immediately.

Secure Email Gateway EUVD-2026-18146

Q: What is the CVSS score of EUVD-2026-18146?

EUVD-2026-18146 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-29133 MEDIUM

Improper Input Validation (CWE-20)

2026-04-02 NCSC.ch

GHSA-g982-ffmg-jq3g

Information Disclosure Secure Email Gateway

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 08:45 euvd

EUVD-2026-18146

Analysis Generated

Apr 02, 2026 - 08:45 vuln.today

CVE Published

Apr 02, 2026 - 08:26 nvd

MEDIUM 5.3

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers to upload PGP keys with mismatched User IDs and email addresses, enabling spoofing and potential information disclosure by circumventing email authentication controls. The vulnerability affects all versions prior to 15.0.3 and was reported by NCSC.ch. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

SEPPmail Secure Email Gateway is an email security appliance that manages PGP key infrastructure for encrypted communications. The vulnerability stems from insufficient input validation (CWE-20: Improper Input Validation) in the PGP key upload mechanism. The system fails to enforce consistency between a PGP key's User ID (UID) field and the actual email address associated with that key in the gateway's trust store. PGP UIDs are metadata fields within a key that typically identify the key owner; when these can be mismatched with registered email addresses, attackers can create keys that appear to belong to legitimate senders while actually being under attacker control. This undermines the core security model of PGP-based secure email by breaking the binding between identity assertion and cryptographic key ownership.

RemediationAI

Vendor-released patch: SEPPmail Secure Email Gateway version 15.0.3 or later. Organizations should immediately upgrade to version 15.0.3 to enforce proper validation of PGP key UIDs against registered email addresses. After patching, administrators should audit existing PGP keys in the gateway trust store to identify and remove any keys with mismatched UIDs or sender addresses; consult the vendor advisory at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503 for detailed upgrade and validation procedures. No workarounds are documented; patching is the primary mitigation.