CVE-2026-114426: falha de alta gravidade em SEPPmail Secure Email Gateway (SEG)
Pre-authentication upload parsing permits resource exhaustion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.3%
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)CVEs relacionadas — SEPPmail Secure Email Gateway (SEG)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-84832HIGHUnsafe deserialization in the REST interfaceEPSS 0.6%CVE-2026-84831HIGHMandatory MFA bypass before enrollmentEPSS 0.5%CVE-2026-114420MEDIUMLDAP wildcard injection exposes GINA recipient accountsEPSS 0.4%CVE-2026-114425CRITICALForged LFT metadata permits arbitrary file read and deletionEPSS 0.3%CVE-2026-114421HIGHEmpty initial password permits GINA account takeoverEPSS 0.3%CVE-2026-114424CRITICALCode execution through double evaluation in address replacement rulesEPSS 0.3%