CVE-2026-84831: Mandatory MFA bypass before enrollment
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to this bypass?
Accounts that are required to use MFA but have not yet completed MFA enrollment are exposed. An attacker must already know the password for such an account.
What level of access could an attacker obtain?
The gateway creates a fully privileged session before mandatory MFA enrollment is complete, allowing access to protected functionality without a second factor.
Which versions should be reviewed?
SEPPmail Secure Email Gateway versions before 15.0.7 are affected. Review accounts that are MFA-required but remain unenrolled and prioritize upgrading to 15.0.7 or later.