Vulnerability · Published Sep 3, 2026 · Assigned by NCSC.ch
CVE-2026-84831Mandatory MFA bypass before enrollment
High 7.7
In plain English
A high-severity improper authentication in SEPPmail Secure Email Gateway (SEG) from SEPPmail AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEPPmail AG | SEPPmail Secure Email Gateway (SEG) | 0 – before 15.0.7 |
Weakness: CWE-287, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N