A new SEPPmail Appliance hotfix release has been published.
Unfortunately, we had to release another hotfix release due to PGP encryption and decryption issues.
The main problem was that many PGP keys are still in use that rely on obsolete algorithms marked as insecure, such as ElGamal or DSS.
The newly included Sequoia GPG rejects these algorithms by default, which caused encryption and decryption problems.
For now, we will allow Sequoia to use all algorithms that are supported by the...
A new SEPPmail Appliance hotfix release has been published.
The primary fix in this release prevents system freezes. In addition, we added static subject settings for the SCEP MPKI connector and fixed a bug in the interim certificate generation logic.
Security
The following CVEs cover the Infoguard findings resolved in version 15.0.4:
- Exposure of Sensitive Information to an Unauthorized Actor (CVE-2026-7864)
- Local File Inclusion (LFI) and Arbitrary File Deletion (CVE-2026-44127)
- ...
D-Trust informs that S/MIME certificates generated before May 04 2026 have a formal error as viewed by the CA/Browser forum as the regulatory body on certificates. According to D-Trust, the formal errors are not a security risk.
Affected certificates (of type „Advanced Personal eID“, „Advanced Enterprise (inkl. SIG/ENC) ID” and „Advanced Team ID“) will be revoked by D-Trust on May 08 2026 at 15:00 CET.
In order to ensure that the automatic renewal of the D-Trust Certificate revocation goes...
A new SEPPmail Appliance hotfix release has been published.
Version 15.0.4 introduced a bug in the SEPPmail appliance where a missing waitpid call after a fork caused the child processes not to terminate, gradually exhausting the maximum number of process IDs allowed for the user running the RuleEngine. This effectively caused the appliance to freeze.
Please see the revision history and the extended release notes for further details.
In order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):
Under MPKI Settings, enable the following:
- “Automatically renew expiring certificates if validity days left less than”
- “Automatically create certificates for active users without certificates” (This will ensure that the...
In order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):
Under MPKI Settings, enable the following:
- “Automatically renew expiring certificates if validity days left less than”
- “Automatically create certificates for active users without certificates” : This will ensure that the...
Swisssign informs that S/MIME certificates generated between July 15 2025 and April 17 2026 have a formal error as viewed by the CA/Browser forum as the regulatory body on certificates. According to Swisssign, the formal errors are not a security risk.
Affected certificates (of type “SwissSign Personal S/MIME E-Mail ID Silver”, ie domain validated certificates) will be revoked by Swisssign on April 22 2026 at 15:00 CET.
The lifecycle of certificates of customers using SEPPmail appliances...
A new SEPPmail Appliance release has been published.
With this release we closed another batch of the ETH Zurich findings:
- High: S/MIME Signature Additional Certificate CVE-2026-29140
- High: Bounded Subject Tag Sanitization CVE-2026-29141
- High: Plaintext secure-mail.html CVE-2026-29142
- High: S/MIME Decryption Impersonation CVE-2026-29143
- High: Unicode Subject Tags CVE-2026-29144
- High: GINA State Confusion Account Takeover CVE-2026-29139
- Medium: PGP Decryption Recipient LDAP...
Swisssign reduces the period for the domain validation from 365 to 198 days as of March 8th 2026 (and further reduction is planned for March 2027).
As a consequence, all previously validated domains where the validation period is more than 198 days ago would become non-validated on March 8th, and thus no new certificates could be issued.
To avoid the sudden change, re-validation for domains of customers in seppmail.cloud which have been last (re-) validated more than 180 days ago have been...
Information Notice about vulnerabilities and fixes in SEPPmail Appliances
- A number of vulnerabilities have been reported through SEPPmails Responsible Disclosure process, and subsequently reported to the swiss National Center for Cybersecurity (NCSC).
- The critical issues reported have been fixed in appliance release 15.0.1.
- In seppmail.cloud, the critical issues have been patched in November 2025, and some findings with lower severity have been deployed in seppmail.cloud in line with...
A new SEPPmail Appliance hotfix release has been published that updates OpenSSL to version 3.0.19 and addresses multiple security findings:
- CVE-2025-15467
- CVE-2025-68160
- CVE-2025-69418
- CVE-2025-69419
- CVE-2025-69420
- CVE-2025-69421
- CVE-2026-22795
- CVE-2026-22796
The OpenSSL vulnerability CVE-2025-15467 also partially affects SEPPmail solutions.
Status of vulnerability mitigation SEPPmail Appliance
A patch release is currently in testing and will be released in the coming days. MSPs, partners and customers are advised to apply the update as soon as available.
We want to point out that the previous appliance release contains fixes for other security findings, and we urge MSPs, partners and customers to update as soon as possible.
Status of...
Appliance Release 14.1.2.1 is a hotfix release to prevent a race condition between two tasks that would otherwise terminate each other and thereby prevent the watchdog from running.
For more information and a complete list of changes please take a look into the extended release notes.
Appliance Release 14.1.1.2 is a hotfix release for a regression error in the handling of the keys used to encrypt GINA cache mails (too many LDAP bind requests). Affected customers noticed a slowdown or freeze of the system.
For more information and a complete list of changes please take a look into the extended release notes.
We are currently unable to reach GMX mail servers. Mail is stored in our outbound queue and delivery will be retried regularly. No mail is lost unless the issue remains for several days.
As this affects all our IP ranges and delivery to other mail providers is possible, we assume this is an issue on GMX side.