CVE-2026-9592 Details
Description
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
A session replay and hijacking vulnerability has been identified in SEPPmail Secure Email Gateway and SEPPmail Cloud versions prior to 15.0.4.2. The issue arises because the session token is exposed in the URL and an HTTP header, allowing attackers to intercept and misuse the token to hijack user sessions in the GINA web portal.
Users can update to SEPPmail version 15.0.4.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#remove-login-redirect-to-prevent-disclosure-of-session-token-information | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SEPPmail Secure Email Gateway | < 15.0.4.2 |
CPE
Remediation
| |
| SEPPmail Cloud | < 15.0.4.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |