CVE-2026-29140
Certificate Injection Vulnerability in SEPPmail Secure Email Gateway
Publication date: 2026-04-02
Last updated on: 2026-04-16
Assigner: Switzerland Government Common Vulnerability Program
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| seppmail | secure_email_gateway | to 15.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to an attacker controlling the certificates used for encrypting emails to the victim. This could compromise the confidentiality of future encrypted communications, potentially allowing unauthorized access to sensitive information.
Can you explain this vulnerability to me?
This vulnerability affects SEPPmail Secure Email Gateway versions before 15.0.3. It allows an attacker to insert attacker-controlled certificates into S/MIME signatures. As a result, these malicious certificates can be used for future encryption directed at the victim.