Information Notice about vulnerabilities and fixes in SEPPmail Appliances

Information Notice about vulnerabilities and fixes in SEPPmail Appliances

• A number of vulnerabilities have been reported through SEPPmails Responsible Disclosure process, and subsequently reported to the swiss National Center for Cybersecurity (NCSC).
• The critical issues reported have been fixed in appliance release 15.0.1.
• In seppmail.cloud, the critical issues have been patched in November 2025, and some findings with lower severity have been deployed in seppmail.cloud in line with the 15.0.1 release.
• In addition, the independent OpenSSL issues have been fixed in appliance release 15.0.2(.1).
• Fixes for further findings of lower severity will be made available with release 15.0.3, currently planned for March 3rd 2026.
• The regular monthly patch (release 15.0.4, last Wednesday of the month, March 31st) will contain some additional fixes.
• The HIN Mailgateway is a special version of the SEPPmail appliance with reduced / specific functionality and is mostly unaffected by the vulnerabilities. Some fixes will however also be included in a future release of the HIN MGW for completeness.

Shortly, a list of CVEs will be provided with summaries of the findings and their fixes (including the release/fix version information). The release notes for 15.0.3 and 15.0.4 will also contain information about the fixes included, together with CVEs where appropriate and available.

We urge all SEPPmail partners to update their customer appliances to release 15.0.2.1 as soon as possible, and to stick to a regular update schedule. Customers in seppmail.cloud will always receive the latest fixes and patches automatically.

Updated information will also be provided in the upcoming SEPPmail partner webinar on March 5th 2026. To register please click here.