Which versions of Seppmail are affected by EUVD-2026-18166?

SEPPmail Secure Email Gateway versions prior to 15.0.3 contain a cryptographic validation flaw that allows attackers to forge email headers within S/MIME-encrypted messages, potentially deceiving…. A patch is available.

How to fix or mitigate EUVD-2026-18166?

Within 24 hours: Identify all SEPPmail Secure Email Gateway instances and document current versions in your environment. Within 7 days: Test vendor-released patch version 15.0.3 or later in a staging environment and develop a deployment plan. Within 30 days: Deploy patched versions to all production SEPPmail Secure Email Gateway systems and validate cryptographic validation functionality post-upgrade.

Seppmail EUVD-2026-18166

Q: What is the CVSS score of EUVD-2026-18166?

EUVD-2026-18166 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-29143 HIGH

Improper Input Validation (CWE-20)

2026-04-02 NCSC.ch

GHSA-q7v7-25qx-fcxf

Information Disclosure Seppmail Secure Email Gateway

7.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 19:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 09:00 euvd

EUVD-2026-18166

Analysis Generated

Apr 02, 2026 - 09:00 vuln.today

CVE Published

Apr 02, 2026 - 08:49 nvd

HIGH 7.8

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 fails to properly authenticate inner messages within S/MIME-encrypted MIME entities, permitting attackers to manipulate trusted email headers and potentially forge message authenticity. This vulnerability affects the cryptographic validation layer of the gateway, enabling header injection attacks that could deceive users about message origin or content integrity. No CVSS score, EPSS data, or active exploitation confirmation is available in current intelligence.

Technical ContextAI

S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for digitally signing and encrypting email messages using public key cryptography. The vulnerability stems from improper authentication of the inner MIME message structure within encrypted entities, classified under CWE-20 (Improper Input Validation). SEPPmail Secure Email Gateway, identified via CPE cpe:2.3:a:seppmail:secure_email_gateway, is an enterprise email security appliance that processes and validates email messages. The flaw allows an attacker to craft a malicious S/MIME-encrypted message where the inner message headers are not cryptographically bound to the signature verification, creating a gap between the encrypted outer layer and the authenticated inner content. This is distinct from standard S/MIME parsing and reflects a gap in the authentication chain during message decryption and header extraction.

RemediationAI

Vendor-released patch: SEPPmail Secure Email Gateway version 15.0.3 and later. Organizations should upgrade immediately to version 15.0.3 or any subsequent release. Detailed remediation steps and release notes are available in the official SEPPmail advisory at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503. No interim workarounds are documented; patching is the primary remediation path.