Seppmail EUVD-2026-18166

Remote unauthenticated attacker can exploit SEPPmail Secure Email Gateway versions before 15.0.3 by sending S/MIME-encrypted MIME emails. No user interaction required. Affects all default installations processing S/MIME-encrypted messages.

Real-world risk assessment is constrained by absent CVSS vector, EPSS score, and KEV confirmation data. However, the vulnerability targets a core email security function-header authentication in encrypted messages-which is fundamental to preventing email spoofing and fraud. The attack vector appears to be remote (mail delivery) with low complexity, requiring only the ability to send a crafted S/MIME message. The information disclosure and header manipulation nature suggests moderate-to-high business impact for organizations relying on SEPPmail for email authenticity validation. The NCSC.ch reporting attribution suggests governmental security review, implying serious scrutiny. Without active exploitation confirmation or public POC data, this appears to be a logic flaw discovered during security review rather than an actively weaponized threat at time of analysis. Organizations using SEPPmail should prioritize patching based on their reliance on the gateway for trusted email filtering and authentication.

An attacker crafts a malicious email with an S/MIME-encrypted outer layer but manipulates the inner message headers (such as From, To, or Subject) after encryption to impersonate a trusted sender or alter message context. When the SEPPmail gateway processes the email, it decrypts and displays the message to the recipient without properly validating that the inner headers match the cryptographic signature, causing the user to trust a forged or altered header as authentic. The attack requires only the ability to send email to the target organization and knowledge of S/MIME message structure; no authentication or special privileges are required.