CVE-2026-114421: falha de alta gravidade em SEPPmail Secure Email Gateway (SEG)
Empty initial password permits GINA account takeover
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)CVEs relacionadas — SEPPmail Secure Email Gateway (SEG)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-84832HIGHUnsafe deserialization in the REST interfaceEPSS 0.6%CVE-2026-84831HIGHMandatory MFA bypass before enrollmentEPSS 0.5%CVE-2026-114420MEDIUMLDAP wildcard injection exposes GINA recipient accountsEPSS 0.4%CVE-2026-114425CRITICALForged LFT metadata permits arbitrary file read and deletionEPSS 0.3%CVE-2026-114426HIGHPre-authentication upload parsing permits resource exhaustionEPSS 0.3%CVE-2026-114424CRITICALCode execution through double evaluation in address replacement rulesEPSS 0.3%