\nA new SEPPmail Appliance release has been published. Please see the revision history and the extended release notes for further details.
\n\nA quick-fix release for 15.1.0 was necessary because of an error in the GINA domain settings page in the Admin GUI.
\n\nAffected versions: ≤15.0.6.1 - CVE-ID: Pending - CVSS Score: 9.9
\nDescription: Insufficient authorization controls in a cryptographic management API could allow an authenticated user with limited permissions to perform operations beyond their intended scope, potentially affecting system-wide trust configuration.
\nFix Description: Restrict access to the REST endpoint /crypto/rootca to MSP tokens.
\nAffected versions: ≤15.1.0 - CVE-ID: Pending - CVSS Score: 7.1
\nDescription: Insufficient output sanitization in the log viewer could allow specially crafted message data to execute unintended browser-side content when viewed by an administrator.
\nFix Description: Escape all external data to prevent content execution.
\nUpdated internal command execution to use safer command-handling mechanisms.
\n\nThe extension setup of SEPPmail Cloud CH instance is about to go live. With new high performance servers we are ready for future growth. In mid September traffic will start with a few selected NFR partner domains, before gradually going into production with all customers once the new IP addresses have warmed up sufficiently.
\n\nThe oncoming changes should have no influence on customer experience. However, we advise to perform a few checks to ensure mail flow is not affected by configurations tightened to only the current IP addresses of SEPPmail Cloud.
\nFor all M365 customers: check that certificate based connectors are used to receive mail (this is the case if you used the Powershell-module to create the configuration).
\nFor all other mailhostings: no firewall rules should block mail traffic to and from our IP ranges. Please ensure traffic to and from 86.119.112.0/28 and 2001:620:6:e0b0::/64 are permitted.
\nInline outbound customers: ensure SPF include _spf.ch.seppmail.cloud is used.
\nManual intervention on customer side should only be required if:
\nSPF record was built manually instead of using our include. In such case please add the new IP ranges.
\nIP based connectors or firewall restrictions. In such case either allow all our IP ranges to connect to Port 25.
\nInline customer’s outgoing mail will be sent via 86.119.87.123 and 2001:620:6:e0b0::58 instead of 86.119.38.33 and 2001:620:5ca1:1f0:f816:3eff:fef0:1d65
\nParallel customer’s incoming and outgoing mail will be sent via 86.119.88.140 instead of 86.119.37.4.
\nNo manual intervention on customer side should be necessary unless some firewall restrictions would prevent access to port 25 of those IP addresses.
\nInline customers MX records IP addresses will be updated to 86.119.88.191 and 2001:620:6:e0b0::35 from 86.119.35.35 and 2001:620:5ca1:1f0:f816:3eff:fe96:d78e. No action of any kind should be required on customer side.
\n\nAll previous IP addresses and ranges remain active for the moment. Customers of DE instance are not affected in any way. Our IP addresses are published in https://docs.seppmail.com/ch/cloud/c07_cloud_onboarding_appendix_ip_addresses.html
\n"}],"inserted_at":"2026-09-09T08:46:03","updated_at":"2026-10-01T13:31:28","timezone":null,"service_ids":[5631,5481],"featured_from":"2026-09-09T08:31:31","featured_until":"2026-12-31T11:00:00"},{"id":247938,"title":"New Appliance Release 15.0.7","url":"https://seppmail.statuspal.eu/info_notices/247938","updates":[{"id":525938,"type":"info","description":"A new SEPPmail Appliance release has been published. Please see the [revision history](https://docs.seppmail.com/ch/20_revision-history.html) and the [extended release notes](https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html) for further details.\r\n\r\nOne important point worth mentioning is that Microsoft has switched to the new DigiCert Global Root G2 Certificate Authority. It is therefore highly recommended that you import this certificate into SEPPmail and mark it as trusted to avoid communication issues with Exchange Online.\r\nMore information can be found [here](https://techcommunity.microsoft.com/blog/exchange/trust-digicert-global-root-g2-certificate-authority-to-avoid-exchange-online-ema/4488311). \r\n\r\n### Admin\r\n\r\n* **64063 - Error while deleting a user**\r\n Fixed an issue that could prevent a local user from being deleted when associated certificate revocation was processed.\r\n \r\n* **63328 - Error while setting time zone**\r\n Fixed an issue that prevented time zone settings from being changed or saved correctly.\r\n\r\n### Background tasks\r\n\r\n* **Log old running refresh_maillog_cache.pl processes**\r\n Improved handling and logging of previously running background processes. This prevents overlapping processes from contributing to excessive resource consumption and system instability.\r\n\r\n### Cfgserver\r\n\r\n* **63328 - Error while setting time zone**\r\n Fixed an issue that prevented time zone settings from being changed or saved correctly.\r\n\r\n### Clustering\r\n\r\n* **LFM sync not possible because of missing injection connections**\r\n Fixed an issue in the connector.pl service which failed to stop first run injection connections.\r\n\r\n### Operating system\r\n\r\n* **63155 - Cluster view shows SSH warning for cluster member status**\r\n Updated SSH-related configuration and warning handling to avoid unnecessary warnings when displaying cluster member status.\r\n\r\n### RestAPI\r\n\r\n* **Fix /mailprocessing/ruleset/generate OpenAPI Documentation**\r\n Corrected the API documentation so requests generated according to the specification are accepted as expected.\r\n\r\n### Rule engine\r\n\r\n* **RuleEngine temp directory is not volatile**\r\n Corrected temporary directory handling to ensure required processing data remains available while the Rule Engine instance is in use.\r\n\r\n* **63349 - make_lft() drops old output directory which leads to an empty LFT mail**\r\n Fixed an issue where generated LFT messages could be missing encrypted attachments due to incorrect output directory handling.\r\n\r\n* **63491 - Add specific log output if revocation check is skipped because the next update time for the used CRL is not reached**\r\n Improved logging to provide a clearer explanation when a revocation check is intentionally skipped.\r\n\r\n### Security\r\n\r\n* **OS command injection in privileged configuration handling**\r\n **Affected versions:** <15.0.7 - **CVE-ID:** [CVE-2026-84830](https://www.cve.org/CVERecord?id=CVE-2026-84830) - **CVSS Score:** 8.6\r\n **Description:** SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.\r\n **Fix Description:** All affected values will be escaped not.\r\n\r\n* **Bypassing mandatory multi-factor authentication (MFA)**\r\n **Affected versions:** <15.0.7 - **CVE-ID:** [CVE-2026-84831](https://www.cve.org/CVERecord?id=CVE-2026-84831) - **CVSS Score:** 7.7\r\n **Description:** Under certain conditions, the authentication process could allow a user to gain access before all required multi-factor authentication steps had been completed.\r\n **Fix Description:** The authentication flow was tightened to ensure all required MFA checks are completed before access is granted.\r\n\r\n* **Unsecure deserialisation in customer import REST endpoint with possible command execution**\r\n **Affected versions:** <15.0.6 - **CVE-ID:** [CVE-2026-84832](https://www.cve.org/CVERecord?id=CVE-2026-84832) - **CVSS Score:** 8.6\r\n **Description:** A vulnerability in the processing of specially crafted input could potentially lead to unintended command execution in the affected component.\r\n **Fix Description:** Additional validation and safer command-handling mechanisms were introduced to prevent malicious input from being executed.\r\n\r\n### Webmail\r\n\r\n* **Processing of hashdecrypt result used wrong secret**\r\n Corrected an issue where cached webmail data could be validated using an incorrect value, potentially preventing it from being processed correctly.\r\n\r\n* **Fix Session->set() usage**\r\n Corrected session handling where certain values were not applied as expected, which could cause a session to remain in an incorrect state.\r\n\r\n\r\n","inserted_at":"2026-09-03T21:07:40","updated_at":"2026-09-03T21:07:40","posted_at":"2026-09-03T20:48:44","subscribers_notified_at":"2026-09-03T21:07:40","description_html":"\nA new SEPPmail Appliance release has been published. Please see the revision history and the extended release notes for further details.
\n\nOne important point worth mentioning is that Microsoft has switched to the new DigiCert Global Root G2 Certificate Authority. It is therefore highly recommended that you import this certificate into SEPPmail and mark it as trusted to avoid communication issues with Exchange Online.
\nMore information can be found here.
\n64063 - Error while deleting a user
\nFixed an issue that could prevent a local user from being deleted when associated certificate revocation was processed.
\n63328 - Error while setting time zone
\nFixed an issue that prevented time zone settings from being changed or saved correctly.
\nRuleEngine temp directory is not volatile
\nCorrected temporary directory handling to ensure required processing data remains available while the Rule Engine instance is in use.
\n63349 - make_lft() drops old output directory which leads to an empty LFT mail
\nFixed an issue where generated LFT messages could be missing encrypted attachments due to incorrect output directory handling.
\n63491 - Add specific log output if revocation check is skipped because the next update time for the used CRL is not reached
\nImproved logging to provide a clearer explanation when a revocation check is intentionally skipped.
\nOS command injection in privileged configuration handling
\nAffected versions: <15.0.7 - CVE-ID: CVE-2026-84830 - CVSS Score: 8.6
\nDescription: SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
\nFix Description: All affected values will be escaped not.
\nBypassing mandatory multi-factor authentication (MFA)
\nAffected versions: <15.0.7 - CVE-ID: CVE-2026-84831 - CVSS Score: 7.7
\nDescription: Under certain conditions, the authentication process could allow a user to gain access before all required multi-factor authentication steps had been completed.
\nFix Description: The authentication flow was tightened to ensure all required MFA checks are completed before access is granted.
\nUnsecure deserialisation in customer import REST endpoint with possible command execution
\nAffected versions: <15.0.6 - CVE-ID: CVE-2026-84832 - CVSS Score: 8.6
\nDescription: A vulnerability in the processing of specially crafted input could potentially lead to unintended command execution in the affected component.
\nFix Description: Additional validation and safer command-handling mechanisms were introduced to prevent malicious input from being executed.
\nProcessing of hashdecrypt result used wrong secret
\nCorrected an issue where cached webmail data could be validated using an incorrect value, potentially preventing it from being processed correctly.
\nFix Session->set() usage
\nCorrected session handling where certain values were not applied as expected, which could cause a session to remain in an incorrect state.
\nA new SEPPmail Appliance hotfix release has been published.
\n\nRuleEngine:
\n\nPlease see the revision history and the extended release notes for further details.
\n"}],"inserted_at":"2026-07-22T15:16:55","updated_at":"2026-07-22T15:16:55","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-07-22T15:15:10","featured_until":null},{"id":243288,"title":"New Appliance Release 15.0.6","url":"https://seppmail.statuspal.eu/info_notices/243288","updates":[{"id":515486,"type":"info","description":"A new SEPPmail Appliance release has been published. Please see the [revision history](https://docs.seppmail.com/ch/20_revision-history.html) and the [extended release notes](https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html) for further details.\r\n","inserted_at":"2026-07-21T20:37:23","updated_at":"2026-07-21T20:37:23","posted_at":"2026-07-21T18:20:12","subscribers_notified_at":"2026-07-21T20:37:23","description_html":"\nA new SEPPmail Appliance release has been published. Please see the revision history and the extended release notes for further details.
\n"}],"inserted_at":"2026-07-21T20:37:23","updated_at":"2026-07-21T20:37:23","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-07-21T18:20:12","featured_until":null},{"id":237185,"title":"New Appliance Release 15.0.5","url":"https://seppmail.statuspal.eu/info_notices/237185","updates":[{"id":502446,"type":"info","description":"A new SEPPmail Appliance release has been published. \r\n\r\n**Admin:**\r\n- Fixed an issue where a CSR could not be displayed in the detail view\r\n- Enforce new admin password after initial login\r\n- Check that the private key and the certificate match when importing an SSL certificate that was issued on the basis of a generated CSR\r\n- Disable all DNS local zone input fields if \"Use DHCP settings\" is selected\r\n\r\n**System Services:**\r\n- Fixed an issue in the auto revocation process\r\n- Fixed failing ruleset generation at startup on HIN appliances\r\n\r\n**Clustering:**\r\n- Extend the connector service to support more complex cluster configurations\r\n\r\n**Logging:**\r\n- Fixed an issue in DB-based logging when there are no entries in the database\r\n\r\n**MPKI:**\r\n- Successful access to EJBCA via SCEP\r\n\r\n**OpenPGP:**\r\n- Switch crypto backend for Sequoia GPG to provide support for legacy algorithms\r\n- Fixed an issue whereby a failed PGP decryption was treated as successful\r\n\r\n**RestAPI:**\r\n- Fixed an issue in the `/mailsystem/template` endpoint when adding templates/disclaimers\r\n- Fixed an issue in the `/system/dns/localzones/{domainName}` endpoint with the DELETE operation\r\n- Fixed an issue with setting a customer's `maximumEncryptionLicenses` and `maximumLFTLicenses` settings\r\n- Fixed an issue with an empty response for `Crypto/Keymaterial`\r\n- Fixed an issue when creating a webmail user\r\n- Fixed an issue with a path parameter in PUT and DELETE of endpoint `/mailsystem/manageddomain/{domainName}/group/{groupName}`\r\n\r\n**Security:**\r\n- Fixed a possible path traversal vulnerability in PDF generation, found by Infoguard ([CVE-2026-8811](https://www.cve.org/CVERecord?id=CVE-2026-8811))\r\n - With the same vulnerability disclosure, Infoguard found some SSH configuration issues for our update server.\r\n- Base64-encode all PGP decrypted content to prevent MIME structure injection\r\n- Refactor the `hashencrypt` function, used by `pwsend` and cache mode, to use AES-256-CBC with PBKDF2 (CVE pending)\r\n - Since we already had planned the refactoring, this function was also criticised by ETH.\r\n\r\n**Webmail (GINA):**\r\n- Fixed an issue in the webmail password reset process\r\n- Use PBKDF2-512 as password hashing algorithm (CVE pending)\r\n - The old hashing algorithm was criticised in the ETH findings\r\n\r\nPlease see the [revision history](https://docs.seppmail.com/ch/20_revision-history.html) and the [extended release notes](https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html) for further details.\r\n","inserted_at":"2026-05-30T13:45:18","updated_at":"2026-05-30T13:45:18","posted_at":"2026-05-30T13:33:24","subscribers_notified_at":"2026-05-30T13:45:18","description_html":"\nA new SEPPmail Appliance release has been published.
\n\nAdmin:
\n\nSystem Services:
\n\nClustering:
\n\nLogging:
\n\nMPKI:
\n\nOpenPGP:
\n\nRestAPI:
\n/mailsystem/template endpoint when adding templates/disclaimers /system/dns/localzones/{domainName} endpoint with the DELETE operation maximumEncryptionLicenses and maximumLFTLicenses settings Crypto/Keymaterial /mailsystem/manageddomain/{domainName}/group/{groupName} \nSecurity:
\nhashencrypt function, used by pwsend and cache mode, to use AES-256-CBC with PBKDF2 (CVE pending) \nWebmail (GINA):
\n\nPlease see the revision history and the extended release notes for further details.
\n"}],"inserted_at":"2026-05-30T13:45:18","updated_at":"2026-05-30T13:45:18","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-05-30T13:33:24","featured_until":null},{"id":236411,"title":"Warning: Inbound/Outbound Mail Routing Issue (PowerShell Cloud Module v2.5.0)","url":"https://seppmail.statuspal.eu/info_notices/236411","updates":[{"id":500656,"type":"info","description":"###### Summary\r\nWe have identified an issue in the recently released PowerShell Cloud Module version 2.5.0. A regular expression (regex) failure in this version causes outbound emails to bypass the designated outbound connector, delivering them directly through Exchange Online (EXO) instead.\r\n###### Impact\r\nIf you have deployed or updated transport rules using version 2.5.0, your outbound mail routing may not be processing as intended and will bypass the seppmail.cloud secure gateway.\r\n###### Immediate Mitigation Steps\r\nIf you have already created or updated transport rules using version 2.5.0, you must correct the exception regex string to restore proper mail flow.\r\n###### PowerShell Fix (Recommended)\r\nConnect to Exchange Online PowerShell and run the following command to update the exception pattern on the rule:\r\n###### PowerShell\r\nSet-TransportRule -Identity '[SEPPmail.cloud] - 200 Route outgoing e-mails to SEPPmail' -ExceptIfFromAddressMatchesPatterns '^$|^<>$'\r\nNote: A permanent fix is being integrated into Release 2.5.1, which will be available shortly. If you have not yet updated to v2.5.0, we highly recommend skipping it and waiting for v2.5.1.","inserted_at":"2026-05-22T16:17:00","updated_at":"2026-05-22T16:17:00","posted_at":"2026-05-22T16:14:53","subscribers_notified_at":"2026-05-22T16:17:00","description_html":"\nWe have identified an issue in the recently released PowerShell Cloud Module version 2.5.0. A regular expression (regex) failure in this version causes outbound emails to bypass the designated outbound connector, delivering them directly through Exchange Online (EXO) instead.
\n\nIf you have deployed or updated transport rules using version 2.5.0, your outbound mail routing may not be processing as intended and will bypass the seppmail.cloud secure gateway.
\n\nIf you have already created or updated transport rules using version 2.5.0, you must correct the exception regex string to restore proper mail flow.
\n\nConnect to Exchange Online PowerShell and run the following command to update the exception pattern on the rule:
\n\nSet-TransportRule -Identity ‘[SEPPmail.cloud] - 200 Route outgoing e-mails to SEPPmail’ -ExceptIfFromAddressMatchesPatterns ‘^$|^<>$’
\nNote: A permanent fix is being integrated into Release 2.5.1, which will be available shortly. If you have not yet updated to v2.5.0, we highly recommend skipping it and waiting for v2.5.1.
\nA new SEPPmail Appliance hotfix release has been published.
\n\nUnfortunately, we had to release another hotfix release due to PGP encryption and decryption issues.
\nThe main problem was that many PGP keys are still in use that rely on obsolete algorithms marked as insecure, such as ElGamal or DSS.
\nThe newly included Sequoia GPG rejects these algorithms by default, which caused encryption and decryption problems.
\nFor now, we will allow Sequoia to use all algorithms that are supported by the original GPG.
\nIn upcoming releases, we will add warnings for these algorithms. Later, we will also add configuration settings to enable or disable their use.
\nPlease see the revision history and the extended release notes for further details.
\n"}],"inserted_at":"2026-05-11T18:17:32","updated_at":"2026-05-11T18:17:32","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-05-11T18:09:46","featured_until":null},{"id":231866,"title":"UPDATE: SwissSign - renewal of S/MIME Silver certificates (On Prem)","url":"https://seppmail.statuspal.eu/info_notices/231866","updates":[{"id":491154,"type":"info","description":"In order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):\r\nUnder MPKI Settings, enable the following:\r\n* \"Automatically renew expiring certificates if validity days left less than\"\r\n* \"Automatically create certificates for active users without certificates\" : This will ensure that the Automatic Renewal Job, that takes place nightly, will be able to reissue the revoked SwissSign certificates.\r\n\r\nWe also highly recommend, that the \"Automatically renew expiring certificates if validity days left less than\" Option be set to 281 days. This is so that all of the certificates that are potentially marked for revocation are renewed before the revocation takes place. Therefore, there is no interruption of certificate services.\r\n\r\nThe setting changes mentioned above can safely be reverted starting 23.04.2026.","inserted_at":"2026-04-20T14:04:47","updated_at":"2026-04-20T14:04:47","posted_at":"2026-04-20T13:56:57","subscribers_notified_at":"2026-04-20T14:04:47","description_html":"\nIn order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):
\nUnder MPKI Settings, enable the following:
\nWe also highly recommend, that the “Automatically renew expiring certificates if validity days left less than” Option be set to 281 days. This is so that all of the certificates that are potentially marked for revocation are renewed before the revocation takes place. Therefore, there is no interruption of certificate services.
\n\nThe setting changes mentioned above can safely be reverted starting 23.04.2026.
\n"}],"inserted_at":"2026-04-20T14:04:47","updated_at":"2026-04-20T14:04:47","timezone":null,"service_ids":[27401,27402],"featured_from":"2026-04-20T13:56:57","featured_until":null}],"maintenances":[],"upcoming_maintenances":[],"current_status_type":null}