Seppmail EUVD-2026-18158

SEPPmail Secure Email Gateway versions before 15.0.3. Remote unauthenticated attacker exploits GINA account initialization feature to reset victim account passwords. No user interaction required. Default configurations are vulnerable.

Although CVSS and EPSS data are unavailable, the vulnerability poses critical real-world risk. The attack vector is network-based with low complexity (account takeover via a logic flaw typically requires minimal exploitation effort), and the authentication requirement is none-unauthenticated attackers can exploit this. The CWE-288 classification (Authentication Bypass) combined with account takeover capability indicates high technical impact: complete compromise of user email accounts and potential access to sensitive communications. The fact that NCSC.ch (Swiss National Cyber Security Centre) issued a disclosure suggests this was treated as a serious threat requiring coordinated vulnerability disclosure. The availability of a vendor patch (version 15.0.3) indicates the issue was confirmed and reproducible. Remediation is straightforward: upgrade immediately. Organizations running versions prior to 15.0.3 should treat this as a critical priority.

An attacker with network access to a SEPPmail Secure Email Gateway discovers the GINA initialization endpoint does not enforce authentication. The attacker sends a crafted request to the initialization function targeting a known user account (e.g., admin@company.com) with a new password value. The gateway accepts the reset without verifying the attacker's identity, and the attacker then uses the new credentials to log in to the victim account and access all emails and forwarded messages.