CVE-2026-84831

CVE-2026-84831

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.

Vulnerability class: Broken Authentication

EPSS: 0.004 (37.6th percentile) — read the EPSS interpretation.

Weakness classification (CWE)

References