CVE-2026-29140

CVE-2026-29140 impacts SEPPmail Secure Email Gateway versions before 15.0.3, enabling an attacker to dictate future encrypted communications. An unauthenticated remote attacker can achieve this by embedding attacker-controlled certificates within S/MIME signatures, leading the gateway to use these malicious certificates for subsequent encryption to a victim. This vulnerability is rated 7.7 High on CVSSv4, primarily posing a significant risk to confidentiality by potentially allowing access to encrypted email content. There is currently no evidence of active exploitation, public exploit code, or widespread community discussion, and it is not listed on CISA's Known Exploited Vulnerabilities catalog.