{"services":[{"id":5630,"name":"Global Services","description":null,"children":[{"id":5487,"name":"Login Page","description":null,"children":[],"current_incident_type":null},{"id":5485,"name":"Cloud REST API","description":null,"children":[],"current_incident_type":null},{"id":10454,"name":"Quarantine Reports","description":null,"children":[],"current_incident_type":null},{"id":11469,"name":"2FA SMS Service Provider","description":"Service Provider to send two-factor authentication via SMS","children":[],"current_incident_type":null},{"id":13415,"name":"Swisssign Certificate Authority","description":null,"children":[],"current_incident_type":null}],"current_incident_type":null},{"id":5631,"name":"CH Instance","description":null,"children":[{"id":5481,"name":"Mailflow CH Instance","description":null,"children":[],"current_incident_type":null},{"id":5488,"name":"GINA Interface","description":null,"children":[],"current_incident_type":null}],"current_incident_type":null},{"id":5632,"name":"EU Instance","description":null,"children":[{"id":5629,"name":"Mailflow EU Instance","description":null,"children":[],"current_incident_type":null},{"id":35024,"name":"GINA Interface DE","description":null,"children":[],"current_incident_type":null}],"current_incident_type":null},{"id":7558,"name":"External Services","description":"Services external to seppmail.cloud for which SEPPmail is not directly responsible. This section is used to notify about incidents involving third-party services which may impact our partners and customers.","children":[{"id":7559,"name":"M365 Mailhosting","description":"Mailflow to or from Microsoft365","children":[],"current_incident_type":null},{"id":7561,"name":"DNS-Providers","description":"DNS-related providers (registrars, hosting of authoritative zones, ISP or independent resolver services)","children":[],"current_incident_type":null},{"id":21254,"name":"Non-SEPPmail-related incidents","description":"We list incidents which are not directly related to SEPPmail, but which may have an impact on customers under this service. Examples include, but are not limited to: new botnets or spam waves, major security threats involving e-mail services, outages of globally or locally relevant major services.","children":[],"current_incident_type":null}],"current_incident_type":null},{"id":27401,"name":"SEPPmail Appliances","description":null,"children":[{"id":27402,"name":"Licence and Update Services","description":null,"children":[],"current_incident_type":null},{"id":27403,"name":"Appliance Release Info","description":null,"children":[],"current_incident_type":null}],"current_incident_type":null},{"id":33271,"name":"Website","description":null,"children":[],"current_incident_type":null}],"status_page":{"name":"SEPPmail","url":"www.seppmail.com","subdomain":"seppmail","time_zone":"Europe/Zurich","current_incident_type":null,"default_lang":"en"},"incidents":[],"info_notices":[{"id":237185,"title":"New Appliance Release 15.0.5","url":"https://seppmail.statuspal.eu/info_notices/237185","updates":[{"id":502446,"type":"info","description":"A new SEPPmail Appliance release has been published. \r\n\r\n**Admin:**\r\n- Fixed an issue where a CSR could not be displayed in the detail view\r\n- Enforce new admin password after initial login\r\n- Check that the private key and the certificate match when importing an SSL certificate that was issued on the basis of a generated CSR\r\n- Disable all DNS local zone input fields if \"Use DHCP settings\" is selected\r\n\r\n**System Services:**\r\n- Fixed an issue in the auto revocation process\r\n- Fixed failing ruleset generation at startup on HIN appliances\r\n\r\n**Clustering:**\r\n- Extend the connector service to support more complex cluster configurations\r\n\r\n**Logging:**\r\n- Fixed an issue in DB-based logging when there are no entries in the database\r\n\r\n**MPKI:**\r\n- Successful access to EJBCA via SCEP\r\n\r\n**OpenPGP:**\r\n- Switch crypto backend for Sequoia GPG to provide support for legacy algorithms\r\n- Fixed an issue whereby a failed PGP decryption was treated as successful\r\n\r\n**RestAPI:**\r\n- Fixed an issue in the `/mailsystem/template` endpoint when adding templates/disclaimers\r\n- Fixed an issue in the `/system/dns/localzones/{domainName}` endpoint with the DELETE operation\r\n- Fixed an issue with setting a customer's `maximumEncryptionLicenses` and `maximumLFTLicenses` settings\r\n- Fixed an issue with an empty response for `Crypto/Keymaterial`\r\n- Fixed an issue when creating a webmail user\r\n- Fixed an issue with a path parameter in PUT and DELETE of endpoint `/mailsystem/manageddomain/{domainName}/group/{groupName}`\r\n\r\n**Security:**\r\n- Fixed a possible path traversal vulnerability in PDF generation, found by Infoguard ([CVE-2026-8811](https://www.cve.org/CVERecord?id=CVE-2026-8811))\r\n  - With the same vulnerability disclosure, Infoguard found some SSH configuration issues for our update server.\r\n- Base64-encode all PGP decrypted content to prevent MIME structure injection\r\n- Refactor the `hashencrypt` function, used by `pwsend` and cache mode, to use AES-256-CBC with PBKDF2 (CVE pending)\r\n  - Since we already had planned the refactoring, this function was also criticised by ETH.\r\n\r\n**Webmail (GINA):**\r\n- Fixed an issue in the webmail password reset process\r\n- Use PBKDF2-512 as password hashing algorithm (CVE pending)\r\n  - The old hashing algorithm was criticised in the ETH findings\r\n\r\nPlease see the [revision history](https://docs.seppmail.com/ch/20_revision-history.html) and the [extended release notes](https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html) for further details.\r\n","inserted_at":"2026-05-30T13:45:18","updated_at":"2026-05-30T13:45:18","posted_at":"2026-05-30T13:33:24","subscribers_notified_at":"2026-05-30T13:45:18","description_html":"<p>\nA new SEPPmail Appliance release has been published. </p>\n<p>\n<strong>Admin:</strong></p>\n<ul>\n  <li>\nFixed an issue where a CSR could not be displayed in the detail view  </li>\n  <li>\nEnforce new admin password after initial login  </li>\n  <li>\nCheck that the private key and the certificate match when importing an SSL certificate that was issued on the basis of a generated CSR  </li>\n  <li>\nDisable all DNS local zone input fields if “Use DHCP settings” is selected  </li>\n</ul>\n<p>\n<strong>System Services:</strong></p>\n<ul>\n  <li>\nFixed an issue in the auto revocation process  </li>\n  <li>\nFixed failing ruleset generation at startup on HIN appliances  </li>\n</ul>\n<p>\n<strong>Clustering:</strong></p>\n<ul>\n  <li>\nExtend the connector service to support more complex cluster configurations  </li>\n</ul>\n<p>\n<strong>Logging:</strong></p>\n<ul>\n  <li>\nFixed an issue in DB-based logging when there are no entries in the database  </li>\n</ul>\n<p>\n<strong>MPKI:</strong></p>\n<ul>\n  <li>\nSuccessful access to EJBCA via SCEP  </li>\n</ul>\n<p>\n<strong>OpenPGP:</strong></p>\n<ul>\n  <li>\nSwitch crypto backend for Sequoia GPG to provide support for legacy algorithms  </li>\n  <li>\nFixed an issue whereby a failed PGP decryption was treated as successful  </li>\n</ul>\n<p>\n<strong>RestAPI:</strong></p>\n<ul>\n  <li>\nFixed an issue in the <code class=\"inline\">/mailsystem/template</code> endpoint when adding templates/disclaimers  </li>\n  <li>\nFixed an issue in the <code class=\"inline\">/system/dns/localzones/{domainName}</code> endpoint with the DELETE operation  </li>\n  <li>\nFixed an issue with setting a customer’s <code class=\"inline\">maximumEncryptionLicenses</code> and <code class=\"inline\">maximumLFTLicenses</code> settings  </li>\n  <li>\nFixed an issue with an empty response for <code class=\"inline\">Crypto/Keymaterial</code>  </li>\n  <li>\nFixed an issue when creating a webmail user  </li>\n  <li>\nFixed an issue with a path parameter in PUT and DELETE of endpoint <code class=\"inline\">/mailsystem/manageddomain/{domainName}/group/{groupName}</code>  </li>\n</ul>\n<p>\n<strong>Security:</strong></p>\n<ul>\n  <li>\nFixed a possible path traversal vulnerability in PDF generation, found by Infoguard (<a target=\"_blank\" href=\"https://www.cve.org/CVERecord?id=CVE-2026-8811\">CVE-2026-8811</a>)    <ul>\n      <li>\nWith the same vulnerability disclosure, Infoguard found some SSH configuration issues for our update server.      </li>\n    </ul>\n  </li>\n  <li>\nBase64-encode all PGP decrypted content to prevent MIME structure injection  </li>\n  <li>\nRefactor the <code class=\"inline\">hashencrypt</code> function, used by <code class=\"inline\">pwsend</code> and cache mode, to use AES-256-CBC with PBKDF2 (CVE pending)    <ul>\n      <li>\nSince we already had planned the refactoring, this function was also criticised by ETH.      </li>\n    </ul>\n  </li>\n</ul>\n<p>\n<strong>Webmail (GINA):</strong></p>\n<ul>\n  <li>\nFixed an issue in the webmail password reset process  </li>\n  <li>\nUse PBKDF2-512 as password hashing algorithm (CVE pending)    <ul>\n      <li>\nThe old hashing algorithm was criticised in the ETH findings      </li>\n    </ul>\n  </li>\n</ul>\n<p>\nPlease see the <a target=\"_blank\" href=\"https://docs.seppmail.com/ch/20_revision-history.html\">revision history</a> and the <a target=\"_blank\" href=\"https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html\">extended release notes</a> for further details.</p>\n"}],"inserted_at":"2026-05-30T13:45:18","updated_at":"2026-05-30T13:45:18","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-05-30T13:33:24","featured_until":null},{"id":236411,"title":"Warning: Inbound/Outbound Mail Routing Issue (PowerShell Cloud Module v2.5.0)","url":"https://seppmail.statuspal.eu/info_notices/236411","updates":[{"id":500656,"type":"info","description":"###### Summary\r\nWe have identified an issue in the recently released PowerShell Cloud Module version 2.5.0. A regular expression (regex) failure in this version causes outbound emails to bypass the designated outbound connector, delivering them directly through Exchange Online (EXO) instead.\r\n###### Impact\r\nIf you have deployed or updated transport rules using version 2.5.0, your outbound mail routing may not be processing as intended and will bypass the seppmail.cloud secure gateway.\r\n###### Immediate Mitigation Steps\r\nIf you have already created or updated transport rules using version 2.5.0, you must correct the exception regex string to restore proper mail flow.\r\n###### PowerShell Fix (Recommended)\r\nConnect to Exchange Online PowerShell and run the following command to update the exception pattern on the rule:\r\n###### PowerShell\r\nSet-TransportRule -Identity '[SEPPmail.cloud] - 200 Route outgoing e-mails to SEPPmail' -ExceptIfFromAddressMatchesPatterns '^$|^<>$'\r\nNote: A permanent fix is being integrated into Release 2.5.1, which will be available shortly. If you have not yet updated to v2.5.0, we highly recommend skipping it and waiting for v2.5.1.","inserted_at":"2026-05-22T16:17:00","updated_at":"2026-05-22T16:17:00","posted_at":"2026-05-22T16:14:53","subscribers_notified_at":"2026-05-22T16:17:00","description_html":"<h6>\nSummary</h6>\n<p>\nWe have identified an issue in the recently released PowerShell Cloud Module version 2.5.0. A regular expression (regex) failure in this version causes outbound emails to bypass the designated outbound connector, delivering them directly through Exchange Online (EXO) instead.</p>\n<h6>\nImpact</h6>\n<p>\nIf you have deployed or updated transport rules using version 2.5.0, your outbound mail routing may not be processing as intended and will bypass the seppmail.cloud secure gateway.</p>\n<h6>\nImmediate Mitigation Steps</h6>\n<p>\nIf you have already created or updated transport rules using version 2.5.0, you must correct the exception regex string to restore proper mail flow.</p>\n<h6>\nPowerShell Fix (Recommended)</h6>\n<p>\nConnect to Exchange Online PowerShell and run the following command to update the exception pattern on the rule:</p>\n<h6>\nPowerShell</h6>\n<p>\nSet-TransportRule -Identity ‘[SEPPmail.cloud] - 200 Route outgoing e-mails to SEPPmail’ -ExceptIfFromAddressMatchesPatterns ‘^$|^&lt;&gt;$’  <br />\nNote: A permanent fix is being integrated into Release 2.5.1, which will be available shortly. If you have not yet updated to v2.5.0, we highly recommend skipping it and waiting for v2.5.1.</p>\n"}],"inserted_at":"2026-05-22T16:17:00","updated_at":"2026-05-22T16:17:00","timezone":null,"service_ids":[5631,5481,5632,5629,7558,7559],"featured_from":"2026-05-22T16:14:53","featured_until":null},{"id":234947,"title":"New Hotfix Appliance Release 15.0.4.3","url":"https://seppmail.statuspal.eu/info_notices/234947","updates":[{"id":497589,"type":"info","description":"A new SEPPmail Appliance hotfix release has been published. \r\n\r\nUnfortunately, we had to release another hotfix release due to PGP encryption and decryption issues.\r\nThe main problem was that many PGP keys are still in use that rely on obsolete algorithms marked as insecure, such as ElGamal or DSS.\r\nThe newly included Sequoia GPG rejects these algorithms by default, which caused encryption and decryption problems.\r\nFor now, we will allow Sequoia to use all algorithms that are supported by the original GPG.\r\nIn upcoming releases, we will add warnings for these algorithms. Later, we will also add configuration settings to enable or disable their use.\r\n\r\n\r\nPlease see the [revision history](https://docs.seppmail.com/ch/20_revision-history.html) and the [extended release notes](https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html) for further details.\r\n","inserted_at":"2026-05-11T18:17:32","updated_at":"2026-05-11T18:17:32","posted_at":"2026-05-11T18:09:46","subscribers_notified_at":"2026-05-11T18:17:32","description_html":"<p>\nA new SEPPmail Appliance hotfix release has been published. </p>\n<p>\nUnfortunately, we had to release another hotfix release due to PGP encryption and decryption issues.  <br />\nThe main problem was that many PGP keys are still in use that rely on obsolete algorithms marked as insecure, such as ElGamal or DSS.  <br />\nThe newly included Sequoia GPG rejects these algorithms by default, which caused encryption and decryption problems.  <br />\nFor now, we will allow Sequoia to use all algorithms that are supported by the original GPG.  <br />\nIn upcoming releases, we will add warnings for these algorithms. Later, we will also add configuration settings to enable or disable their use.</p>\n<p>\nPlease see the <a target=\"_blank\" href=\"https://docs.seppmail.com/ch/20_revision-history.html\">revision history</a> and the <a target=\"_blank\" href=\"https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html\">extended release notes</a> for further details.</p>\n"}],"inserted_at":"2026-05-11T18:17:32","updated_at":"2026-05-11T18:17:32","timezone":null,"service_ids":[27401,27403],"featured_from":"2026-05-11T18:09:46","featured_until":null},{"id":231866,"title":"UPDATE: SwissSign - renewal of S/MIME Silver certificates (On Prem)","url":"https://seppmail.statuspal.eu/info_notices/231866","updates":[{"id":491154,"type":"info","description":"In order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):\r\nUnder MPKI Settings, enable the following:\r\n* \"Automatically renew expiring certificates if validity days left less than\"\r\n* \"Automatically create certificates for active users without certificates\" : This will ensure that the Automatic Renewal Job, that takes place nightly, will be able to reissue the revoked SwissSign certificates.\r\n\r\nWe also highly recommend, that the \"Automatically renew expiring certificates if validity days left less than\" Option be set to 281 days. This is so that all of the certificates that are potentially marked for revocation are renewed before the revocation takes place. Therefore, there is no interruption of certificate services.\r\n\r\nThe setting changes mentioned above can safely be reverted starting 23.04.2026.","inserted_at":"2026-04-20T14:04:47","updated_at":"2026-04-20T14:04:47","posted_at":"2026-04-20T13:56:57","subscribers_notified_at":"2026-04-20T14:04:47","description_html":"<p>\nIn order to ensure that the automatic renewal of the SwissSign Silver Certificate revocation goes smoothly for the SEPPmail Appliances, we recommend the following setting changes to be in effect as soon as possible (and not later than 22.04.2026 at 15:00 GMT+2):  <br />\nUnder MPKI Settings, enable the following:</p>\n<ul>\n  <li>\n“Automatically renew expiring certificates if validity days left less than”  </li>\n  <li>\n“Automatically create certificates for active users without certificates” : This will ensure that the Automatic Renewal Job, that takes place nightly, will be able to reissue the revoked SwissSign certificates.  </li>\n</ul>\n<p>\nWe also highly recommend, that the “Automatically renew expiring certificates if validity days left less than” Option be set to 281 days. This is so that all of the certificates that are potentially marked for revocation are renewed before the revocation takes place. Therefore, there is no interruption of certificate services.</p>\n<p>\nThe setting changes mentioned above can safely be reverted starting 23.04.2026.</p>\n"}],"inserted_at":"2026-04-20T14:04:47","updated_at":"2026-04-20T14:04:47","timezone":null,"service_ids":[27401,27402],"featured_from":"2026-04-20T13:56:57","featured_until":null}],"maintenances":[],"upcoming_maintenances":[],"current_status_type":null}