Unicode Spoofing Bypass in SEPPmail Email Gateway

Publication date: 2026-04-02

Last updated on: 2026-04-16

Assigner: Switzerland Government Common Vulnerability Program

Description

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-02

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-29144

EUVD

EUVD-2026-18168

Affected Vendors & Products

Vendor	Product	Version / Range
seppmail	secure_email_gateway	to 15.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects SEPPmail Secure Email Gateway versions before 15.0.3. It allows an attacker to bypass the sanitization process of email subjects by using Unicode lookalike characters. This means the attacker can forge security tags in the email subject line that appear legitimate but are actually manipulated.

Impact Analysis

The impact of this vulnerability is that an attacker can manipulate email subjects to forge security tags, potentially misleading recipients or security systems about the nature or trustworthiness of the email. This could lead to security breaches such as phishing, spoofing, or bypassing email security policies.

Hi! I’m here to help you understand CVE-2026-29144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70