SEPPmail Secure Email Gateway prior to version 15.0.3 contains an improper certificate validation vulnerability (CWE-295) identified as CVE-2026-29140. The flaw allows an attacker to add attacker-controlled certificates to S/MIME signatures, which the system then trusts for encrypting future messages to the victim. This undermines the integrity of the certificate validation process and can lead to interception or manipulation of encrypted email communications. The vulnerability has a CVSS 4.0 score of 7.7, reflecting network attack vector, low attack complexity, no privileges or user interaction required, but limited impact on confidentiality and high scope change.

An attacker can cause the SEPPmail Secure Email Gateway to use malicious certificates for encrypting emails to a victim, potentially enabling interception or decryption of sensitive communications. This compromises the trust model of S/MIME encryption and may lead to unauthorized data disclosure. The vulnerability affects confidentiality primarily, with a high severity rating. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the SEPPmail vendor advisory for current remediation guidance. Since the product is not a cloud service, remediation depends on applying vendor-provided updates. Until a patch is available, users should exercise caution with S/MIME certificates and consider additional email security controls if feasible.