CVE-2026-29138 impacts SEPPmail Secure Email Gateway versions prior to 15.0.3, allowing an attacker to claim another user's PGP signature through a specially crafted email address. This is a medium-severity vulnerability (CVSS 6.3) with a network attack vector and low attack complexity, primarily affecting system integrity by enabling signature impersonation. While the vulnerability could lead to trust issues, there is no indication of active exploitation. Public exploit code is not available, and community discussion is minimal, suggesting a very low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 15.0.3CPE matchmatch criteria | cpe:2.3:a:seppmail:secure_email_gateway:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.