CVE-2026-29139 GINA State Confusion Account Takeover

High 7.8 Published 2 Apr 2026 Updated 2 Apr 2026

Attackers can take over victim accounts by abusing GINA account initialization to reset passwords in SEPPmail Secure Email Gateway.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-29139?

CVE-2026-29139 is a high-severity authentication bypass vulnerability in SEPPmail Secure Email Gateway, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.

Weakness: CWE-288

Which versions are affected by CVE-2026-29139?

It affects 1 product.

Products include Seppmail Secure Email Gateway.

How do I fix CVE-2026-29139?

No fix has been published for CVE-2026-29139 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-29139 being exploited?

There is no known exploitation of CVE-2026-29139 in the wild and no public exploit code.

Sources

Also known as GHSA-8q8m-rvgf-6qvc.