SEPPmail Secure Email Gateway EUVD-2026-28589

Successful exploitation requires the GINA UI component to be accessible to the attacker (typically via network/internet exposure of the administrative interface) AND specific template plugins must be enabled that permit dangerous operations beyond simple variable substitution. The CVSS 4.0 AT:P (Attack Requirements: Present) metric explicitly indicates this is NOT a universal exploit against all SEPPmail deployments - the template engine configuration, enabled plugins, and potentially specific GINA UI features determine actual exploitability. Exploitation is LIMITED by: template plugin configuration (restrictive plugin sets may only allow information disclosure rather than RCE), network access controls to the GINA UI (properly segmented admin interfaces are not remotely accessible), and the specific template engine implementation's security features. Organizations with GINA UI restricted to management VLANs or with minimal template plugin sets face substantially lower real-world risk than internet-exposed instances with full plugin suites enabled.

The CVSS 4.0 vector indicates network-accessible exploitation with low attack complexity and no authentication required (AV:N/AC:L/PR:N), but the AT:P (Attack Requirements: Present) metric signals that specific conditions must exist for successful exploitation - likely the presence of vulnerable template plugins or specific GINA UI configurations. High confidentiality impact (VC:H) with low integrity and availability impacts (VI:L/VA:L) suggests the primary risk is data exfiltration with secondary capability for system modification. The lack of CISA KEV listing and no identified public proof-of-concept reduces immediate widespread exploitation risk, but the network attack vector and zero authentication requirement make this a priority for organizations running affected versions. The Swiss NCSC report attribution suggests this may have been discovered through coordinated vulnerability disclosure rather than active exploitation. Organizations should prioritize patching email security gateways given their perimeter position and access to sensitive communications, even though the AT:P metric indicates not all deployments may be exploitable in default configurations. The 8.3 severity is justified for exposed instances with vulnerable template plugins enabled, but defenders should verify their specific GINA UI configuration and enabled plugins to assess realistic exposure.

An unauthenticated remote attacker identifies the SEPPmail GINA UI endpoint exposed to the internet and sends a crafted HTTP request containing malicious template expressions in parameters processed by the vulnerable template engine. If exploitation-enabling template plugins are present, the injected template code executes server-side with the privileges of the email gateway application, allowing the attacker to read sensitive email metadata, configuration files, or credentials from the system. Depending on plugin capabilities, the attacker may escalate to full remote code execution, install backdoors, or pivot to internal network resources accessible from the email gateway's position on the network perimeter.