CVE-2026-29135
Published: 02 April 2026
Summary
CVE-2026-29135 is a high-severity Improper Input Validation (CWE-20) vulnerability in Seppmail Secure Email Gateway. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of email subject inputs to prevent crafted password-tags from bypassing sanitization mechanisms.
Requires timely remediation of the specific flaw through application of SEPPmail version 15.0.3 or later patches.
Filters unsanitized email subject content prior to further processing or disclosure by the gateway.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote flaw in an internet-facing email gateway application; exploitation directly enables the T1190 technique by allowing an attacker to send a crafted email that bypasses sanitization and obtains sensitive data.
NVD Description
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization.
Deeper analysisAI
CVE-2026-29135 is an improper input validation vulnerability (CWE-20) affecting SEPPmail Secure Email Gateway versions prior to 15.0.3. The flaw allows an attacker to craft a malicious password-tag that bypasses the application's subject sanitization mechanisms, enabling the processing of unsanitized email subject content. This issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its network accessibility and potential for significant confidentiality impacts.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted email with a password-tag in the subject, the attacker bypasses sanitization controls, potentially leading to the disclosure of sensitive information processed by the gateway, such as confidential email metadata or content that would otherwise be stripped.
SEPPmail's external release notes for version 15.0.3 document this vulnerability disclosure and address it through an update, recommending that users upgrade to version 15.0.3 or later to mitigate the issue (https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503).
Details
- CWE(s)