CVE-2026-29134
Published: 02 April 2026
Summary
CVE-2026-29134 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Seppmail Secure Email Gateway. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations preventing unauthorized external users from modifying GINA webdomain metadata and bypassing per-domain restrictions.
Validates inputs to GINA webdomain functions to reject malicious modifications that circumvent per-domain restrictions.
Requires identification and authentication for non-organizational external users accessing metadata modification capabilities in the Secure Email Gateway.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated network exploitation of public-facing SEPPmail Secure Email Gateway to modify metadata and bypass domain restrictions directly matches T1190.
NVD Description
SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions.
Deeper analysisAI
CVE-2026-29134 is a vulnerability in SEPPmail Secure Email Gateway versions prior to 15.0.3 that allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions. This issue, published on 2026-04-02, carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and is linked to CWE-807.
The vulnerability can be exploited over the network by any unauthenticated external attacker with low attack complexity and no user interaction required. Successful exploitation enables the attacker to alter GINA webdomain metadata, circumventing per-domain restrictions and achieving high integrity impact while preserving confidentiality and availability.
Mitigation is available in SEPPmail Secure Email Gateway version 15.0.3. Additional details on the vulnerability disclosure and patching are provided in the vendor's release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503.
Details
- CWE(s)