This vulnerability (CVE-2026-9592) involves the use of the GET request method with sensitive query strings in SEPPmail Secure Email Gateway and SEPPmail Cloud. The session token is disclosed inside the URL and an HTTP header, enabling an attacker to replay and hijack user sessions in the GINA web portal. The CVSS 4.0 base score is 7.5 (high), reflecting the attack vector as adjacent network with low complexity and no privileges or user interaction required, but with high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

An attacker can capture session tokens exposed in URLs and HTTP headers, allowing session replay and hijacking in the GINA web portal. This compromises user session confidentiality and integrity, potentially granting unauthorized access to user accounts or sensitive information within the affected SEPPmail products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid exposing session tokens in URLs and consider using alternative secure session management practices. Monitor vendor communications for updates on patches or mitigations.