CVE-2026-2748 S/MIME Certificate Subject Whitespace

High 7.8 Published 4 Mar 2026 Updated 4 Mar 2026

Attackers can spoof S/MIME signatures by exploiting improper validation of certificate subjects containing whitespace in SEPPmail Secure Email Gateway.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-2748?

CVE-2026-2748 is a high-severity vulnerability in SEPPmail Secure Email Gateway, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signature spoofing.

Weakness: CWE-295

Which versions are affected by CVE-2026-2748?

It affects 1 product.

Products include Seppmail Seppmail.

How do I fix CVE-2026-2748?

No fix has been published for CVE-2026-2748 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-2748 being exploited?

There is no known exploitation of CVE-2026-2748 in the wild and no public exploit code.

Sources

Also known as GHSA-qg5v-hxpj-p53x.