CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SEPPmail Secure Email Gateway: unauthenticated remote sender reaches root command execution through an address-replacement rule, fixed in 15.1.1 (CVSS 4.0 9.2)

cve · CVE-2026-114424 single-source

Coverage
1
first 2026-11-05 → last 2026-11-05
Latest activity
2026-11-05
SEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix
Peak priority
notable
1 notable
Targets
·
regions: switzerland, dach
Sources cited
7
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-114424, newest first. Check the date before acting on an older one.

  • Upgrade every SEPPmail Secure Email Gateway to 15.1.1 now, moving 15.0.x gateways to the 15.1 branch because 15.0.7 is the last 15.0 release, and check each gateway's active address-replacement rules for values taken from the message and its Large File Transfer setting, the two conditions the CNA names.
    2026-11-05CVE-2026-114424 +4

Defender insights

What each entry about CVE-2026-114424 tells a defender to do, newest first.

2026-11-05NOTABLESEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix

Exposure · detection

Story timeline

  1. 2026-11-05CVE-2026-114424 and CVE-2026-114425, SEPPmail Secure Email Gateway before 15.1.1: an unauthenticated mail sender can reach root command execution through a replacement rule and root file access through Large File Transfer, with three more flaws fixed in the same release and no fix for the 15.0 branch (CVSS 4.0 9.2)
    trending-vulnerabilitiesSEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix

Hunting pivots

Affected products
SEPPmail Secure E-Mail Gateway
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-05/seppmail-gateway-15-1-1-unauth-root-rce-and-file-access · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-11-05/seppmail-gateway-15-1-1-unauth-root-rce-and-file-access · ATT&CK page ↗

Entries about SEPPmail Secure Email Gateway: unauthenticated remote sender reaches root command execution through an address-replacement rule, fixed in 15.1.1 (CVSS 4.0 9.2) (1)

2026-11-05 · view entry permalink →

NOTABLECVE-2026-114424 +4NATOA2

CVE-2026-114424 and CVE-2026-114425, SEPPmail Secure Email Gateway before 15.1.1: an unauthenticated mail sender can reach root command execution through a replacement rule and root file access through Large File Transfer, with three more flaws fixed in the same release and no fix for the 15.0 branch (CVSS 4.0 9.2)

SEPPmail's revision history lists patch release 15.1.1 of 2026-11-03 with five security fixes in the Secure Email Gateway, all for versions before 15.1.1 (SEPPmail, 2026-11-03). Two are unauthenticated and rated 9.2: in CVE-2026-114424 attacker-influenced replacement text in sender or recipient address-replacement rules is evaluated as Perl code, so a remote sender can run operating-system commands in the mail-processing worker when an active rule uses message-derived replacement data and its search condition matches, and the validated worker context was root (ENISA EUVD, 2026-11-04); in CVE-2026-114425 a file path supplied in the attachment metadata of an incoming message lets the worker disclose, move or delete an accessible file when Large File Transfer is enabled, also as root (ENISA EUVD, 2026-11-04). CVE-2026-114426 lets an unauthenticated attacker exhaust workers and disk because the upload interface processed data before checking authentication (ENISA EUVD, 2026-11-04), and two flaws in the GINA webmail let an unauthenticated attacker take over a created but unregistered account with an empty initial password (CVE-2026-114421) and enumerate email addresses through an unescaped LDAP filter (CVE-2026-114420) (ENISA EUVD, 2026-11-04; ENISA EUVD, 2026-11-04). The vendor says 15.0.7 of 2026-09-02 is the last release of the 15.0 branch, so the fix for a 15.0.x gateway is the move to 15.1 (SEPPmail, 2026-11-03). None of the sources read reports exploitation.

An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.

ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114424) 2026-11-04

An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114425) 2026-11-04

This release will be the last release in the 15.0 branch and enable the update to version 15.1.

SEPPmail GmbH (revision history) 2026-11-03

Builds on: An unauthenticated Perl eval() flaw and five more in SEPPmail's gateway, with fixes shipped…

vulnerability05 Nov 03:58Zsingle-sourceOpen finding →
Sources: SEPPmail GmbH (revision history) · ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114424) · ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114425) · ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114426) · ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114421) · ENISA EUVD (CNA text of NCSC.ch, CVE-2026-114420) · SEPPmail GmbH (administration guide, Home page, undated)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu5 (71%)
  • docs.seppmail.com2 (29%)

External references

NVD · cve.org · CISA KEV

All cited sources (7)