Seppmail EUVD-2026-18168

Remote unauthenticated attacker can send crafted emails with Unicode lookalike characters to SEPPmail Secure Email Gateway versions before 15.0.3. No victim interaction required; exploitation occurs during email processing on the gateway itself.

While CVSS score and vector are not available, the vulnerability carries significant real-world risk due to its direct impact on email authentication and user trust. The attack vector is classified as network-based (email delivery), with low complexity and no authentication required, making exploitation trivial for remote attackers. The vulnerability enables email spoofing and phishing-foundational attack techniques-by allowing forge of security indicators that users rely upon to distinguish legitimate from malicious email. CISA KEV status is not confirmed in the provided data, and no public exploit code is referenced, suggesting this may be a pre-disclosure or coordinated disclosure. However, the simplicity of Unicode homoglyph exploitation means threat actors can quickly weaponize this once disclosed, and organizations cannot rely on detection tools to catch attacks using lookalike characters. Patch availability (version 15.0.3) significantly reduces urgency for organizations that can deploy updates rapidly, but unpatched systems face high exploitation probability once the technique becomes known.

An attacker sends a phishing email to a target organization's users with a subject line crafted using Unicode lookalike characters (e.g., Cyrillic 'а' substituted for Latin 'a') designed to visually resemble a legitimate message from an internal department. The attacker also forges security tags by using similar character substitution, making the email appear to bear the organization's authentic security markings. SEPPmail's subject sanitization filter fails to strip or normalize these characters due to inadequate Unicode validation, allowing the email to pass through with the forged tags intact. Users, trusting the seemingly legitimate subject and security indicators, click malicious links or provide credentials, believing they are communicating with trusted internal systems.