CVE-2026-9592CWE-598

Sensitive Information Disclosure in HTTP header

High · published July 17, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U
EPSS
0.00241 · 14.4th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-07-17T13:51Z
EPSS history
Timeline
  • 17 JUL 13:51Z
    Sensitive Information Disclosure in HTTP header
    cvelistv5