CVE-2026-29138
Received Received - Intake
PGP Signature Spoofing in SEPPmail Secure Email Gateway

Publication date: 2026-04-02

Last updated on: 2026-04-16

Assigner: Switzerland Government Common Vulnerability Program

Description
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-02
Last Modified
2026-04-16
Generated
2026-06-16
AI Q&A
2026-04-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-29138
EUVD
EUVD-2026-18156
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
seppmail secure_email_gateway to 15.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects SEPPmail Secure Email Gateway versions before 15.0.3. It allows attackers who use a specially crafted email address to falsely claim another user's PGP signature as their own.

Impact Analysis

The vulnerability can lead to attackers impersonating other users by claiming their PGP signatures. This can undermine the authenticity and trustworthiness of signed emails, potentially leading to unauthorized actions or misinformation being accepted as legitimate.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-29138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart