The vulnerability CVE-2026-29136 affects SEPPmail Secure Email Gateway prior to version 15.0.3. It is classified as CWE-79, indicating improper neutralization of input during web page generation, specifically cross-site scripting (XSS). The issue arises from the ability of an attacker to inject arbitrary HTML into notification emails concerning new CA certificates. This could allow execution of malicious scripts in the context of the email client or web interface rendering these notifications. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed.

Successful exploitation could allow an attacker to execute arbitrary HTML or script code in the context of notification emails about new CA certificates. This may lead to potential information disclosure or manipulation of email content for users who view these notifications. However, the impact is limited by the need for user interaction and the scope of the affected component being notification emails.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 15.0.3, upgrading to version 15.0.3 or later is likely recommended once official guidance is available. Until then, users should exercise caution when interacting with notification emails about new CA certificates and consider additional email filtering or scanning measures.