CVE-2026-29139 is a critical flaw (CVSS 9.8) in SEPPmail Secure Email Gateway. Before version 15.0.3, abusing the GINA account initialization process could reset a victim's account password and take over the account. SEPPmail fixed it in 15.0.3, so update to that release or a later one.
What's affected
The NVD record says SEPPmail Secure Email Gateway before version 15.0.3 is affected. The vendor's release notes for 15.0.3 list the issue, which they call GINA State Confusion Account Takeover, among their high severity fixes.
GINA is the gateway's webmail interface, so organisations that use it are the ones to prioritise.
How to check if you're exposed
Check your appliance version in the SEPPmail admin interface and compare it with 15.0.3. The vendor publishes release notes at downloads.seppmail.com, and the section titled SEPPmail Vulnerability Disclosure 15.0.3 lists the fixed issues. If you run an older major release, the record does not say which other versions are affected, so ask SEPPmail support or read the release notes for your branch.
What to do now
- Update the appliance to 15.0.3 or later, following SEPPmail's upgrade guidance and taking a backup first.
- Review GINA account activity for password resets you cannot explain, especially for recipients who rarely log in.
- Reset passwords for any GINA accounts where you find suspicious activity.
- If you cannot update at once, limit access to the GINA interface to networks that need it, as a stopgap and not a fix.
- Add the gateway to your asset list with its firmware version, so you can find out quickly when the next release note lands.
Why it matters
The record files this under CWE-288, authentication bypass using an alternate path or channel. The vendor describes the problem as state confusion in the account initialization flow, which is the step where a new external user sets up an account. If that step can be triggered against an existing account, it becomes a password reset without proof of ownership.
Email gateways hold sensitive messages, and accounts on a secure messaging portal are often used to receive confidential documents. The record does not give more technical detail, and neither does the release note, so rely on the vendor for specifics. The record does not mark this as exploited in the wild.
Quick check
Which version fixes it?
15.0.3. The NVD record says versions before 15.0.3 are affected.
Where do I find the details?
The vendor's 15.0.3 release notes list it as a high severity fix. The record itself is brief.
Sources
Last reviewed: 19 October 2026.
