A new SEPPmail Appliance release has been published.
With this release we closed another batch of the ETH Zurich findings:

• High: S/MIME Signature Additional Certificate CVE-2026-29140
• High: Bounded Subject Tag Sanitization CVE-2026-29141
• High: Plaintext secure-mail.html CVE-2026-29142
• High: S/MIME Decryption Impersonation CVE-2026-29143
• High: Unicode Subject Tags CVE-2026-29144
• High: GINA State Confusion Account Takeover CVE-2026-29139
• Medium: PGP Decryption Recipient LDAP...

Swisssign reduces the period for the domain validation from 365 to 198 days as of March 8th 2026 (and further reduction is planned for March 2027).

As a consequence, all previously validated domains where the validation period is more than 198 days ago would become non-validated on March 8th, and thus no new certificates could be issued.

To avoid the sudden change, re-validation for domains of customers in seppmail.cloud which have been last (re-) validated more than 180 days ago have been...

Information Notice about vulnerabilities and fixes in SEPPmail Appliances

• A number of vulnerabilities have been reported through SEPPmails Responsible Disclosure process, and subsequently reported to the swiss National Center for Cybersecurity (NCSC).
• The critical issues reported have been fixed in appliance release 15.0.1.
• In seppmail.cloud, the critical issues have been patched in November 2025, and some findings with lower severity have been deployed in seppmail.cloud in line with...