Session Hijacking Vulnerability in SEPPmail Secure Email Gateway and Cloud
CVE-2026-9592

7.5HIGH

Key Information:

Vendor

Seppmail

Status
Seppmail Secure Email Gateway & Seppmail Cloud
Vendor
CVE Published:
17 July 2026

What is CVE-2026-9592?

The SEPPmail Secure Email Gateway and SEPPmail Cloud prior to version 15.0.4.2 are susceptible to session hijacking via a disclosure of session tokens in the URL and HTTP headers. This vulnerability allows attackers to replay and hijack user sessions in the GINA web portal, potentially leading to unauthorized access and manipulation of sensitive information. It's crucial to ensure your systems are updated to the latest version to mitigate this exposure.

Affected Version(s)

SEPPmail Secure Email Gateway & SEPPmail Cloud Windows 15.0.4.2

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.ht...

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aleksandar Marčeta-Pavlović from WKO Inhouse GmbH of the Austrian Economic Chambers
.