Rafael Pfister

Blog

Notes from the field: SEPPmail, totemomail, HIN Mail Gateway, Microsoft 365, and Exchange.

Topics

Admin Hub

Active Directory / Entra Active Directory, Microsoft Entra, LDAP integration, and directory services. 5 articles → Archiving and journaling Compliant email archiving: Exchange journaling, journal mailboxes, Enterprise Vault, and proving that nothing is missing. 1 article → Cisco ESA / SMA Cisco Secure Email Gateway (ESA) and Secure Email and Web Manager (SMA): administration, certificates, and operating the AsyncOS-based mail security appliances. 3 articles → Email Encryption S/MIME, OpenPGP, GINA, and TLS in practice. 7 articles → Exchange OnPrem / Hybrid On-premises Exchange Server, security updates, hybrid connectivity to Exchange Online, and the migration to Exchange SE. 16 articles → Exchange updates (SU & CU) Security updates (SU) and cumulative updates (CU) for Exchange Server in chronological order: closed vulnerabilities, installation pitfalls, and the follow-up work that comes after patch day. 7 articles → FortiMail Fortinet FortiMail as a mail gateway: vulnerabilities, mail routing, encryption (IBE), administration, and operations. 1 article → HIN Gateway The HIN Mail Gateway based on SEPPmail: clusters, backup, Stargate. 5 articles → Kiteworks / Totemomail Totemomail / Kiteworks Email Protection Gateway: operations, routing, licensing. 9 articles → Load Balancers F5 BIG-IP and other load balancers in the mail environment: virtual servers, SNAT, persistence, timeouts, and health monitoring for SMTP traffic. 1 article → Microsoft 365 / Exchange Exchange Online, connectors, mail routing, and hybrid scenarios. 13 articles → Microsoft Entra Entra ID, Entra Connect Sync, and hybrid identity between Active Directory and the cloud. 1 article → Microsoft Teams Microsoft Teams from an operations perspective: media traffic and network requirements, call quality, client specifics, and how Teams interacts with VPNs, firewalls, and proxies. 1 article → Outlook Outlook as a client from an admin perspective: new and classic Outlook, Outlook on the web, account types, shared mailboxes, S/MIME, and the limits of each variant. 1 article → SEPPmail SEPPmail Secure E-Mail Gateway: firmware releases, encryption, cluster operations, and appliance administration. 2 articles → SMTP and Mail Flow Delivery paths, relays, and smarthosts: diagnosing SMTP connections, transport encryption, and sender checks in the mail flow. 19 articles → SMTP Load Testing Measuring throughput and stability of mail systems: load generators such as smtp-source, test setup, traceable test runs, and evaluating the results. 2 articles → Tailscale The WireGuard-based mesh VPN in practice: subnet routers and exit nodes, route approval and ACLs, secure remote access to internal services, and the limits of each operating mode. 1 article → Testing and Load Tests Test plans, load generators, and measurement methodology: probing infrastructure under controlled conditions, from a single SMTP transaction to a 10,000-mail burst, and evaluating the results properly. 5 articles → Vulnerabilities Actively exploited vulnerabilities (CISA KEV) in mail servers, mail gateways, and webmail: affected versions, updates, workarounds, and compromise assessment. 7 articles → Windows client Windows on the desktop from an admin's perspective: Remote Desktop, printing, Group Policy, and the registry tweaks that make the difference in day-to-day support. 5 articles → Zimbra Zimbra Collaboration as a mail and groupware server: vulnerabilities, updates, and operations. 1 article →

AI & Automation Hub

Claude Working with Claude and Claude Code: setting up your own servers securely as a working environment, everyday automation, and running AI tooling on your own infrastructure. 4 articles → Cloudflare Cloudflare as a platform: applications without your own servers on Workers, D1 and Pages, plus WAF rules, security and automation. 1 article → OpenAI API Running the OpenAI API in production: cost control, quotas, and language-model automation outside ChatGPT. 1 article →

Off Topic

Home Assistant and IoT Running connected devices on your own network: local control instead of vendor clouds, Home Assistant and community integrations, network segmentation, firewall rules, and handling long-lived device credentials. 4 articles → Paperless-ngx Running your own document archive with Paperless-ngx: container installation, version upgrades and migrations, storage requirements, backup and restore, and the limits of offloading the document store. 1 article → PC & Hardware BIOS/UEFI maintenance, firmware updates, stability diagnostics and hardware topics around the personal machine. 3 articles → Proton Drive Proton Drive beyond the official apps: the state on Linux, connecting via Rclone and the SDK, unattended authentication, and using it as a store for self-hosted services. 2 articles → Rclone Connecting cloud storage with Rclone: FUSE mounts, the VFS cache, running inside Docker containers, unattended authentication and the pitfalls of individual backends. 3 articles → Remote support Remote access and support with open-source tools: RustDesk as a TeamViewer alternative, direct connections over your own network, unattended access and the limits of free usage. 1 article → VPN and remote access Private networks over the internet: mesh VPN with Tailscale and WireGuard compared with classic IPsec and SSL VPN gateways, least-privilege access rules and connecting existing networks. 1 article →

All articles

NewExchange Outages After the October 2026 Windows Server Updates: MapiExceptionMdbOffline (ec=1142)

After the Windows Server updates of October 13, 2026, Exchange servers report MapiExceptionMdbOffline (ec=1142) after around 24 hours: OWA fails, queues grow, and DAG copies stop replicating. Microsoft confirms the link to the Windows updates, but a fix is not yet available. Symptoms, affected KBs, verification commands, and recommended steps.

October 16, 2026 Exchange updates (SU & CU) 7 min read

NewCVE-2026-76519: Cisco Secure Email Gateway Path Traversal Is Being Exploited - Update and Check for Compromise

A crafted email attachment is all it takes: Through a path traversal vulnerability in the AMP File Reputation feature, attackers can write arbitrary files to Cisco Secure Email Gateway and execute commands with root privileges (CVE-2026-76519, CVSS 9.8). The vulnerability is being exploited. Updating the Content Scanner Tools or AsyncOS and checking for compromise are required.

October 15, 2026 Vulnerabilities 7 min read

NewCVE-2026-96951: Windows Shell Mark of the Web Bypass Is Being Exploited—Install the October Update

On October 13, 2026, Microsoft fixed an already exploited Windows Shell vulnerability (CVE-2026-96951, CVSS 8.8). Crafted files delivered by email or chat can bypass Mark of the Web protection. CISA lists the vulnerability in its KEV catalog; only the cumulative October update resolves it.

October 14, 2026 Vulnerabilities 6 min read

NewOctober 2026 Exchange security updates: six vulnerabilities, final update for Exchange 2016 and 2019

The October SU closes six vulnerabilities, including a critical remote code execution issue through a crafted email, and fixes the .ics issue and the WordBreaker deadlock. It is the final update for Exchange 2016 and 2019, including under the ESU program.

October 14, 2026 Exchange updates (SU & CU) 7 min read

Exchange Security Update September 2026 v2: Early Fix for CVE-2026-96940

On October 2, 2026, Microsoft released version 2 of the September SUs for Exchange SE, 2019, and 2016. It also addresses CVE-2026-96940, an elevation-of-privilege vulnerability with a CVSS score of 8.8 and an “Exploitation More Likely” assessment. Microsoft recommends installing v2 as soon as possible, including on servers running the first September SU.

October 7, 2026 Exchange updates (SU & CU) 5 min read

September 2026 Exchange Security Updates: Nine Vulnerabilities, Wrapper Issue Fixed, v2 Released

The September SU closes nine vulnerabilities in Exchange SE and 2019 (eight in Exchange 2016), including a spoofing vulnerability with CVSS 9.3, and fixes the wrapper issue in hybrid environments. A v2 with an additional CVE followed on October 2; there are also three known issues with workarounds and a SettingOverride that should now be removed.

October 7, 2026 Exchange updates (SU & CU) 11 min read

Connecting digitalSTROM with Home Assistant: local integration and automations

A local Home Assistant integration for the digitalSTROM server, plus motion-activated lighting, shower mode, music with 4× tapping, and automatic leaving via FRITZ!Box. Including the issues encountered in practice.

October 6, 2026 Home Assistant and IoT 13 min read

CVE-2026-73570: Zimbra Command Injection via SNMP Is Being Exploited—Update to 10.1.20 and Check for Compromise

A crafted email is all it takes: On Zimbra servers with the zimbra-snmp package and SNMP notifications enabled, attackers can execute commands as the zimbra user without authentication (CVE-2026-73570, CVSS 8.9). The vulnerability is being exploited and was fixed in 10.1.20. Update, apply the workaround until then, and check for web shells and persistence.

October 6, 2026 Vulnerabilities 8 min read

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Is Being Exploited—Update and Check for Compromise

A specially crafted email is all it takes: via an SQL injection in AsyncOS, attackers can execute commands with root privileges on Cisco Secure Email Gateway (CVE-2026-76461, CVSS 9.8). The vulnerability is being exploited, and no workaround is available. Updating to a fixed version and checking for compromise are required.

October 6, 2026 Vulnerabilities 7 min read

Renewing a Totemomail Certificate: 4096-Bit Key, PKCS#12 Import, and Restarting Each Node

Totemomail’s request dialog generates only 2048-bit keys without alternative names. However, many internal CAs now sign only 4096-bit keys. The key and request are therefore created with openssl, followed by ordering from the PKI team, PKCS#12 import, connector binding, and restarting each node.

October 6, 2026 Kiteworks / Totemomail 12 min read

HIN Mail Login: Webmail, Outlook Token, Forgotten Password, and HIN Mail Global

Where and how to sign in to HIN Mail: webmail at webmail.hin.ch, mail tokens for Outlook and smartphones, login without the HIN Client using an SMS code or Authenticator app, password reset, and opening HIN Mail Global as a recipient without a HIN account.

October 5, 2026 HIN Gateway 7 min read

CVE-2026-104286: FortiMail Zero-Day Is Being Exploited - Workaround and Compromise Assessment

Fortinet reports a critical, actively exploited path traversal vulnerability in FortiMail 7.2 through 8.0 (CVE-2026-104286, CVSS 9.8). A patch is not yet available. The workaround disables IBE or blocks Internet access to the management interface; indicators for assessing compromise are also available.

October 2, 2026 FortiMail 8 min read