CVE-2026-114425: falha crítica em SEPPmail Secure Email Gateway (SEG)
Forged LFT metadata permits arbitrary file read and deletion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 0.3%
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)CVEs relacionadas — SEPPmail Secure Email Gateway (SEG)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-84832HIGHUnsafe deserialization in the REST interfaceEPSS 0.6%CVE-2026-84831HIGHMandatory MFA bypass before enrollmentEPSS 0.5%CVE-2026-114420MEDIUMLDAP wildcard injection exposes GINA recipient accountsEPSS 0.4%CVE-2026-114426HIGHPre-authentication upload parsing permits resource exhaustionEPSS 0.3%CVE-2026-114421HIGHEmpty initial password permits GINA account takeoverEPSS 0.3%CVE-2026-114424CRITICALCode execution through double evaluation in address replacement rulesEPSS 0.3%