CVE-2026-84831 — Mandatory MFA bypass before enrollment

CVE-2026-84831

Mandatory MFA bypass before enrollment PUBLISHED

Description (CNA)

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.

Affected (CNA)

Vendor / product	Versions
SEPPmail AG / SEPPmail Secure Email Gateway (SEG)	affected 0 before 15.0.7

CWE

CWE-287, CWE-306

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.