Which versions of Secure Email Gateway are affected by EUVD-2026-18168?

SEPPmail Secure Email Gateway versions before 15.0.3 contain a Unicode character manipulation vulnerability that allows attackers to bypass email security controls and forge legitimate-appearing…. A patch is available.

How to fix or mitigate EUVD-2026-18168?

Within 24 hours: inventory all SEPPmail deployments and confirm current versions. Within 7 days: apply vendor patch to SEPPmail version 15.0.3 or later across all affected instances; validate patch deployment with test messages. Within 30 days: conduct security awareness training on email authentication limitations and review email filtering rules to add compensating controls for Unicode-based phishing indicators.

Secure Email Gateway EUVD-2026-18168

Q: What is the CVSS score of EUVD-2026-18168?

EUVD-2026-18168 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-29144 HIGH

Improper Input Validation (CWE-20)

2026-04-02 NCSC.ch

GHSA-vc5m-vgvg-698r

Authentication Bypass Secure Email Gateway

7.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 19:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.0.3

EUVD ID Assigned

Apr 02, 2026 - 09:00 euvd

EUVD-2026-18168

Analysis Generated

Apr 02, 2026 - 09:00 vuln.today

CVE Published

Apr 02, 2026 - 08:50 nvd

HIGH 7.8

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters.

AnalysisAI

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers to bypass subject sanitization and forge security tags by exploiting Unicode lookalike characters, enabling email spoofing and phishing attacks that evade gateway security controls. This vulnerability affects all versions prior to 15.0.3, impacts organizations relying on SEPPmail for email security, and requires immediate patching. No public exploit code has been identified at the time of analysis.

Technical ContextAI

The vulnerability stems from insufficient input validation (CWE-20) in SEPPmail's subject line and security tag processing mechanisms. The root cause involves the gateway's failure to normalize or properly validate Unicode characters, allowing attackers to use visually similar Unicode lookalike characters (homoglyphs) to bypass sanitization filters designed to prevent subject line manipulation and forged security tags. Security tags are typically used by email gateways to indicate authentication status, encryption, or other security properties to end users; Unicode homoglyphs can make malicious content appear legitimate to human readers while technically satisfying the gateway's validation logic. The affected product is SEPPmail Secure Email Gateway, a message security and compliance appliance used for email filtering and policy enforcement.

RemediationAI

Vendor-released patch: upgrade SEPPmail Secure Email Gateway to version 15.0.3 or later. Organizations should apply this patch immediately, as the vulnerability enables trivial email spoofing attacks that directly undermine gateway security. Consult the official SEPPmail release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503 for upgrade procedures and any interim mitigations. No workarounds to block Unicode homoglyph attacks are practical without patching the underlying validation logic; temporary compensating controls such as user awareness training about suspicious visual artifacts in subjects may provide minimal defense pending patch deployment.