A new SEPPmail Appliance release has been published.
With this release we closed another batch of the ETH Zurich findings:

• High: S/MIME Signature Additional Certificate CVE-2026-29140
• High: Bounded Subject Tag Sanitization CVE-2026-29141
• High: Plaintext secure-mail.html CVE-2026-29142
• High: S/MIME Decryption Impersonation CVE-2026-29143
• High: Unicode Subject Tags CVE-2026-29144
• High: GINA State Confusion Account Takeover CVE-2026-29139
• Medium: PGP Decryption Recipient LDAP...

Swisssign reduces the period for the domain validation from 365 to 198 days as of March 8th 2026 (and further reduction is planned for March 2027).

As a consequence, all previously validated domains where the validation period is more than 198 days ago would become non-validated on March 8th, and thus no new certificates could be issued.

To avoid the sudden change, re-validation for domains of customers in seppmail.cloud which have been last (re-) validated more than 180 days ago have been...

Information Notice about vulnerabilities and fixes in SEPPmail Appliances

• A number of vulnerabilities have been reported through SEPPmails Responsible Disclosure process, and subsequently reported to the swiss National Center for Cybersecurity (NCSC).
• The critical issues reported have been fixed in appliance release 15.0.1.
• In seppmail.cloud, the critical issues have been patched in November 2025, and some findings with lower severity have been deployed in seppmail.cloud in line with...

A new SEPPmail Appliance hotfix release has been published that updates OpenSSL to version 3.0.19 and addresses multiple security findings:

• CVE-2025-15467
• CVE-2025-68160
• CVE-2025-69418
• CVE-2025-69419
• CVE-2025-69420
• CVE-2025-69421
• CVE-2026-22795
• CVE-2026-22796

The OpenSSL vulnerability CVE-2025-15467 also partially affects SEPPmail solutions.

Status of vulnerability mitigation SEPPmail Appliance

A patch release is currently in testing and will be released in the coming days. MSPs, partners and customers are advised to apply the update as soon as available.

We want to point out that the previous appliance release contains fixes for other security findings, and we urge MSPs, partners and customers to update as soon as possible.

Status of...

Appliance Release 14.1.2.1 is a hotfix release to prevent a race condition between two tasks that would otherwise terminate each other and thereby prevent the watchdog from running.

For more information and a complete list of changes please take a look into the extended release notes.

Appliance Release 14.1.1.2 is a hotfix release for a regression error in the handling of the keys used to encrypt GINA cache mails (too many LDAP bind requests). Affected customers noticed a slowdown or freeze of the system.

For more information and a complete list of changes please take a look into the extended release notes.

We are currently unable to reach GMX mail servers. Mail is stored in our outbound queue and delivery will be retried regularly. No mail is lost unless the issue remains for several days.

As this affects all our IP ranges and delivery to other mail providers is possible, we assume this is an issue on GMX side.