CVE-2026-79300 Overview
CVE-2026-79300 is an authorization weakness in SEP sesam versions prior to 5.2.0.24. The flaw stems from inconsistent username case handling between SEP sesam and Active Directory (AD). SEP sesam treats usernames as case-sensitive, while AD treats them as case-insensitive. When AD authentication is configured with multi-factor authentication (MFA) enforced, an attacker with valid low-privileged credentials can create a second SEP sesam account differing only in letter casing. That duplicate account allows registration of an additional One-Time Password (OTP) Authenticator for the same AD identity, weakening MFA protection. The issue is tracked as [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize].
Critical Impact
An authenticated attacker can register a second OTP Authenticator for an existing AD account, undermining MFA enforcement in SEP sesam backup environments.
Affected Products
- SEP sesam versions before 5.2.0.24
- SEP sesam deployments configured with Active Directory authentication
- SEP sesam deployments with MFA enforcement enabled
Discovery Timeline
- 2026-09-12 - CVE-2026-79300 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-79300
Vulnerability Analysis
The vulnerability results from a canonicalization mismatch between two authentication systems. Active Directory normalizes usernames to a case-insensitive form, treating Alice, alice, and ALICE as the same principal. SEP sesam, by contrast, stores and compares usernames as distinct strings when their casing differs.
An attacker who authenticates as an existing AD user can create additional SEP sesam accounts that map to the same AD identity by varying capitalization. Each SEP sesam account maintains its own MFA registration state. This lets the attacker enroll a second OTP Authenticator bound to attacker-controlled seed material. The result is that MFA no longer guarantees possession of the legitimate user's original authenticator.
Because AD accepts the login regardless of case, the attacker-controlled duplicate account and the legitimate account both resolve to the same underlying identity during authentication, but SEP sesam authorizes the OTP challenge tied to whichever record matched the case-sensitive lookup.
Root Cause
The root cause is [CWE-180]: SEP sesam validates the username before applying canonicalization consistent with the upstream AD identity provider. No case-folding step normalizes SEP sesam usernames against the AD representation prior to account creation or MFA enrollment.
Attack Vector
Exploitation requires network access to the SEP sesam management interface and low-privileged credentials in the target environment. The attacker creates or triggers creation of a SEP sesam account whose username matches an existing AD account but differs in case. The attacker then enrolls an OTP Authenticator against that duplicate record. Subsequent authentication flows honor the attacker's OTP registration for the same AD identity. No user interaction is required.
The vulnerability is described in prose only; no verified proof-of-concept code is public. Refer to the SEP Release Notes 5.2.0 for vendor-provided technical context.
Detection Methods for CVE-2026-79300
Indicators of Compromise
- Multiple SEP sesam user accounts that resolve to the same AD sAMAccountName or userPrincipalName when compared case-insensitively.
- Unexpected OTP Authenticator enrollment events on accounts that already have a registered authenticator.
- SEP sesam audit log entries showing account creation for usernames that differ only in letter casing from existing entries.
Detection Strategies
- Enumerate SEP sesam user records and perform a case-insensitive comparison to identify collisions against AD identities.
- Correlate SEP sesam authentication events with AD sign-in logs to detect divergent MFA registration state for a single AD principal.
- Alert on any newly created SEP sesam account whose normalized username matches an existing account.
Monitoring Recommendations
- Forward SEP sesam application and authentication logs to a centralized analytics platform for continuous review.
- Monitor MFA enrollment events and flag secondary OTP registrations tied to previously enrolled AD identities.
- Review privileged account activity in SEP sesam after applying the patch to confirm no duplicate accounts persist.
How to Mitigate CVE-2026-79300
Immediate Actions Required
- Upgrade SEP sesam to version 5.2.0.24 or later on all servers.
- Audit existing SEP sesam accounts for case-variant duplicates that map to the same AD identity and remove unauthorized entries.
- Re-validate MFA enrollment for all AD-linked SEP sesam accounts after patching.
Patch Information
SEP AG addressed the issue in SEP sesam 5.2.0.24 (Artemis release). Details are available in the SEP Release Notes 5.2.0. Apply the patch on all SEP sesam management servers where AD authentication with MFA is configured.
Workarounds
- Restrict SEP sesam account creation permissions to a small set of administrators until the patch is applied.
- Enforce a naming convention that prevents case-variant duplicates during account provisioning.
- Temporarily disable AD-integrated MFA enrollment for new SEP sesam accounts and require manual validation of enrollment requests.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.