Critical severity · published Apr 2, 2026
CVE-2026-29133
UID Regex Bypass
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · SEPPmail
before 15.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29133
Release Notes
https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503
More from Secure Email Gateway
9.8
CVE-2026-29139
GINA State Confusion Account Takeover
9.8
CVE-2026-27441
PDF Password CMDi
9.1
CVE-2026-29143
S/MIME Decryption Impersonation
7.5
CVE-2026-29138
PGP Decryption Sender LDAP Injection
7.5
CVE-2026-29131
PGP Decryption Recipient LDAP Injection