A new SEPPmail Appliance release has been published.
With this release we closed another batch of the ETH Zurich findings (CVEs pending):

• High: S/MIME Signature Additional Certificate
• High: Bounded Subject Tag Sanitization
• High: Plaintext secure-mail.html
• High: S/MIME Decryption Impersonation
• High: Unicode Subject Tags
• High: GINA State Confusion Account Takeover
• Medium: PGP Decryption Recipient LDAP Injection
• Low: ESWmail-Verify Bypass
• Low: UID Regex Bypass
• Low: GINA...

Swisssign reduces the period for the domain validation from 365 to 198 days as of March 8th 2026 (and further reduction is planned for March 2027).

As a consequence, all previously validated domains where the validation period is more than 198 days ago would become non-validated on March 8th, and thus no new certificates could be issued.

To avoid the sudden change, re-validation for domains of customers in seppmail.cloud which have been last (re-) validated more than 180 days ago have been...

Information Notice about vulnerabilities and fixes in SEPPmail Appliances

• A number of vulnerabilities have been reported through SEPPmails Responsible Disclosure process, and subsequently reported to the swiss National Center for Cybersecurity (NCSC).
• The critical issues reported have been fixed in appliance release 15.0.1.
• In seppmail.cloud, the critical issues have been patched in November 2025, and some findings with lower severity have been deployed in seppmail.cloud in line with...

A new SEPPmail Appliance hotfix release has been published that updates OpenSSL to version 3.0.19 and addresses multiple security findings:

• CVE-2025-15467
• CVE-2025-68160
• CVE-2025-69418
• CVE-2025-69419
• CVE-2025-69420
• CVE-2025-69421
• CVE-2026-22795
• CVE-2026-22796