SEPPmail Secure Email Gateway EUVD-2026-28586

Exploitation requires network connectivity to the SEPPmail Secure Email Gateway GINA UI interface (typically HTTPS on TCP 443 or 8443). No authentication, user interaction, or special configuration is required-the vulnerability affects default configurations where the GINA UI is enabled and network-accessible. Limiting factors: SEPPmail Secure Email Gateway must be running a version prior to 15.0.4; the administrative GINA UI must be reachable from the attacker's network position (exploitation blocked if administrative interfaces are restricted to management VLANs or protected by IP allowlists); specific vulnerable endpoints within the GINA UI must be targeted, though multiple endpoints are affected per description. Exploitation is NOT limited by: deployment mode, email volume, existing sessions, or time-of-day restrictions. This is remote unauthenticated exploitation against default configurations of network-exposed administrative interfaces in SEPPmail Secure Email Gateway versions prior to 15.0.4.

Real-world risk is CRITICAL for internet-exposed installations. CVSS 9.3 accurately reflects severity: network vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) mean any remote attacker reaching the interface can exploit this. The CVSS 4.0 threat metrics show no supplemental metric modifications (all X values), indicating the base score stands without environmental adjustments. However, exploitation probability depends heavily on exposure-email gateways are often perimeter devices but may be protected by network segmentation or IP restrictions. No EPSS score provided in data, but the attack surface (administrative web UI) and zero authentication requirement suggest this would score high if exposed. Not listed in CISA KEV, indicating no confirmed active exploitation campaigns as of analysis date, which may reflect either limited deployment footprint of SEPPmail products or effective vendor notification. Public exploit code availability is unknown from provided data. SSVC framework assessment: Exploitation status appears 'none' (no KEV), automatable is 'yes' (network exploit requiring no interaction), technical impact is 'total' (complete system control). Priority recommendation: IMMEDIATE patching for internet-facing instances; HIGH priority for internal instances if administrative networks are untrusted.

An unauthenticated attacker scans for internet-exposed SEPPmail Secure Email Gateway instances using Shodan or similar reconnaissance tools, identifying installations by HTTP banners or certificate information. The attacker directly accesses vulnerable GINA UI endpoints without authentication credentials, invoking administrative functions such as user management, email policy modification, or configuration export to extract credentials and sensitive email routing rules. With complete administrative access achieved through the authorization bypass, the attacker can disable email security filters, exfiltrate archived emails, or pivot to internal networks by modifying email gateway routing configurations.