CVE-2026-114424: critical vulnerability in SEPPmail Secure Email Gateway (SEG)
Code execution through double evaluation in address replacement rules
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.3%
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)Related CVEs — SEPPmail Secure Email Gateway (SEG)
In the same product, most dangerous first.
CVE-2026-84832HIGHUnsafe deserialization in the REST interfaceEPSS 0.6%CVE-2026-84831HIGHMandatory MFA bypass before enrollmentEPSS 0.5%CVE-2026-114420MEDIUMLDAP wildcard injection exposes GINA recipient accountsEPSS 0.4%CVE-2026-114425CRITICALForged LFT metadata permits arbitrary file read and deletionEPSS 0.3%CVE-2026-114426HIGHPre-authentication upload parsing permits resource exhaustionEPSS 0.3%CVE-2026-114421HIGHEmpty initial password permits GINA account takeoverEPSS 0.3%