CVE-2026-84831 — Mandatory MFA bypass before enrollment
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password…
Published: 2026-09-03 · CVSS: 7.7 · CVSS 4.0
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7