CVE-2026-84831

CVE-2026-84831 is a multi-factor authentication bypass (CWE-287/CWE-306) in SEPPmail Secure Email Gateway: the appliance establishes a fully privileged session before the required MFA enrollment process has been completed. An attacker who already possesses the password for an account that is subject to MFA but has not yet finished enrollment can log in and reach protected functionality without supplying a second factor. The attacker gains privileged access to the gateway's protected functions, with the CVSS 4.0 vector rating confidentiality, integrity and availability impact on the vulnerable system as High; the precondition (AT:P) that a targeted MFA-required account is still unenrolled narrows the practical attack window. Organizations running SEPPmail Secure Email Gateway versions before 15.0.7 are affected. No exploitation is currently known: the flaw is not in CISA KEV, no public proof of concept exists, and EPSS assigns a 0.4% probability of exploitation within 30 days (percentile 38).

What to do: Upgrade SEPPmail Secure Email Gateway to 15.0.7 or later, the first fixed release named in the advisory. As an interim mitigation, ensure every MFA-required account completes enrollment immediately after account creation or password reset (only unenrolled accounts are exposed by this flaw), restrict access to the gateway's administration interface to trusted networks, and review authentication logs for privileged logins that were accepted without a second factor.