Which versions of SEPPmail Secure Email Gateway are affected by EUVD-2026-28586?

SEPPmail Secure Email Gateway versions before 15.0.4 contain a critical authorization bypass that allows unauthenticated remote attackers to access administrative interfaces, potentially enabling…. A patch is available.

How to fix or mitigate EUVD-2026-28586?

Within 24 hours: Identify all SEPPmail Secure Email Gateway instances and their versions (below 15.0.4); disable or restrict network access to GINA UI endpoints if possible, and isolate internet-facing instances behind additional network segmentation. Within 7 days: Apply vendor upgrade to SEPPmail version 15.0.4 or later across all affected systems; verify upgrade completion and validate GINA UI authentication requirements are enforced post-patch. Within 30 days: Conduct administrative access audit on all SEPPmail instances to detect unauthorized changes; review security event logs for suspicious GINA UI access attempts dating back to system deployment.

SEPPmail Secure Email Gateway EUVD-2026-28586

Q: What is the CVSS score of EUVD-2026-28586?

EUVD-2026-28586 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-44125 CRITICAL

Missing Authorization (CWE-862)

2026-05-08 NCSC.ch

GHSA-x76h-jjpq-cp24

Authentication Bypass Secure Email Gateway

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 08, 2026 - 14:33 EUVD

Analysis Generated

May 08, 2026 - 14:31 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

9.3 (CRITICAL)

CVE Published

May 08, 2026 - 13:15 nvd

CRITICAL 9.3

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.

AnalysisAI

Authorization bypass in SEPPmail Secure Email Gateway versions prior to 15.0.4 enables remote unauthenticated attackers to access privileged GINA UI endpoints without authentication. The vulnerability (CISA reported by Swiss NCSC) affects core access control mechanisms with CVSS 9.3 critical severity, allowing complete system compromise through network-accessible administrative interfaces. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication barrier presents immediate risk to internet-facing deployments.

Technical ContextAI

The vulnerability stems from missing authorization checks (CWE-862: Missing Authorization) in multiple endpoints of SEPPmail's GINA UI component. CWE-862 represents a failure to verify whether a user has permission to access a resource or perform an action, distinct from authentication failures. In this case, the GINA UI (likely a web-based administrative interface for the Secure Email Gateway) exposes multiple endpoints that process privileged operations without validating session tokens or user permissions. The affected product CPE (cpe:2.3:a:seppmail_ag:secure_email_gateway) indicates this impacts SEPPmail AG's email security gateway appliance, which typically handles email filtering, encryption, and policy enforcement for enterprise environments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is a network-exploitable vulnerability requiring no prerequisites-attackers need only network access to the GINA UI interface to invoke protected functionality. The High confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) indicate complete system compromise potential.

RemediationAI

Upgrade to SEPPmail Secure Email Gateway version 15.0.4 or later, as documented in the vendor's external release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security. The release notes confirm version 15.0.4 addresses this authorization bypass vulnerability in the GINA UI component. If immediate patching is not feasible, implement compensating controls: restrict network access to the GINA UI administrative interface through firewall rules permitting only trusted management networks (note this reduces attack surface but does not eliminate risk from internal threats or compromised management stations); disable external access to administrative ports entirely if remote management is not required (typically TCP 443/8443 for web interfaces); deploy a web application firewall with rules blocking unauthenticated access to administrative paths if GINA UI endpoints can be enumerated. These mitigations reduce exposure but do not fix the underlying authorization flaw-version upgrade remains the only complete remediation. Organizations should verify patch deployment through version validation and test that administrative access controls function correctly post-upgrade.