CVE-2026-29143 is a critical flaw (CVSS 9.1) in SEPPmail Secure Email Gateway. Before version 15.0.3, the inner message of S/MIME-encrypted MIME entities was not properly authenticated, so an attacker could control headers the gateway trusts. The fix is in 15.0.3, so update to it or later.
What's affected
The NVD record lists SEPPmail Secure Email Gateway versions before 15.0.3. The vendor's release notes for 15.0.3 name this issue S/MIME Decryption Impersonation and place it among the high severity fixes.
It applies to deployments that process S/MIME encrypted mail through the gateway.
How to check if you're exposed
Check your appliance version in the SEPPmail admin interface and compare it with 15.0.3. The vendor publishes release notes at downloads.seppmail.com, and the section titled SEPPmail Vulnerability Disclosure 15.0.3 lists the fixed issues. If you run an older major release, the record does not say which other versions are affected, so ask SEPPmail support or read the release notes for your branch. Also check whether your gateway decrypts S/MIME mail for your users, since that is the path the record describes.
What to do now
- Update to SEPPmail 15.0.3 or later after taking a backup and reading the release notes.
- Review mail handling rules that depend on headers, such as routing or trust decisions, and note which headers the gateway treats as authoritative.
- Check mail logs for decrypted messages whose headers do not match what you would expect from the sender.
- Tell your mail administrators what changed, so unexpected rule behaviour after the update gets reported.
- Keep a record of the appliance version and update date for your change log.
Why it matters
The record files this under CWE-20, improper input validation. In plain terms, the gateway handled the content inside an encrypted message without confirming that it was authentic, and then let that content influence headers it trusts. A header the gateway believes can drive decisions about who sent a message or how it should be handled.
The vendor's notes call it impersonation, which fits. Mail systems depend on a small set of trusted headers, and any path that lets outside content set them is worth fixing quickly. The record gives no more detail than that, so the release notes are the place to look. The record does not mark this as exploited in the wild.
Quick check
Is this the same as CVE-2026-29139?
No. Both were fixed in 15.0.3, but this one concerns S/MIME headers and the other concerns account takeover.
Does it need a login?
The vector says no privileges are required.
Sources
Last reviewed: 19 October 2026.
