S/MIME Authentication Bypass in SEPPmail Gateway Before

Publication date: 2026-04-02

Last updated on: 2026-04-16

Assigner: Switzerland Government Common Vulnerability Program

Description

SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-02

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-29143

EUVD

EUVD-2026-18166

Affected Vendors & Products

Vendor	Product	Version / Range
seppmail	secure_email_gateway	to 15.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects SEPPmail Secure Email Gateway versions before 15.0.3. It occurs because the software does not properly authenticate the inner message of S/MIME-encrypted MIME entities. As a result, an attacker can manipulate or control trusted email headers within these encrypted messages.

Impact Analysis

The vulnerability allows an attacker to control trusted headers in S/MIME-encrypted emails, which can lead to spoofing or manipulation of email content that is normally trusted. This could result in unauthorized actions, misinformation, or bypassing security controls that rely on these headers.

Hi! I’m here to help you understand CVE-2026-29143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70