CVE-2026-9592
Received Received - Intake

Session Replay and Hijacking in SEPPmail Gateway

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: Switzerland Government Common Vulnerability Program

Description
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-9592
EUVD
EUVD-2026-45174

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
seppmail secure_email_gateway to 15.0.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to replay and hijack a user session in the SEPPmail GINA web portal. The issue occurs because the session token is exposed in both the URL and an HTTP header, making it easy for an attacker to capture and reuse the token to impersonate the user.

Impact Analysis

An attacker could gain unauthorized access to your SEPPmail account, read sensitive emails, send emails on your behalf, or perform actions as if they were you. This could lead to data breaches, unauthorized transactions, or further compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update SEPPmail Secure Email Gateway & Cloud to version 15.0.4.2 or later to address the session token disclosure issue in the GINA web portal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart