CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SEPPmail Secure Email Gateway, unauthenticated RCE via exposed GINAv2 test endpoints (CVSS 9.3)

cve · CVE-2026-44128

Coverage
1
first 2026-05-09 → last 2026-10-11
Latest activity
2026-05-20
An unauthenticated Perl eval() flaw and five more in SEPPmail's gateway, with fixes shipped from 15.0.2.1 to…
Peak priority
high
1 high
Targets
·
regions: switzerland, dach, europe
Sources cited
6
6 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-44128, newest first. Check the date before acting on an older one.

  • Upgrade every SEPPmail appliance to the current 15.0.x release; where LFT is licensed, confirm the build includes the CVE-2026-2743 fix.
    2026-05-09CVE-2026-44128 +6

Defender insights

What each entry about CVE-2026-44128 tells a defender to do, newest first.

2026-05-09HIGHAn unauthenticated Perl eval() flaw and five more in SEPPmail's gateway, with fixes shipped from 15.0.2.1 to 15.0.4

Exposure · detection

Story timeline

  1. 2026-05-09SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4
    trending-vulnerabilitiesAn unauthenticated Perl eval() flaw and five more in SEPPmail's gateway, with fixes shipped from 15.0.2.1 to 15.0.4

Hunting pivots

Affected products
SEPPmail Secure E-Mail Gateway
Tags
patch-availablepath-traversalpre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2026-44128-et-al-seppmail-secure-email-gateway-cvss-9-3 · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-05-09/cve-2026-44128-et-al-seppmail-secure-email-gateway-cvss-9-3 · ATT&CK page ↗

Entries about SEPPmail Secure Email Gateway, unauthenticated RCE via exposed GINAv2 test endpoints (CVSS 9.3) (1)

2026-05-09 · view entry permalink →

HIGHCVE-2026-44128 +6updatedNATOA2

SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4

NCSC-CH's Security Hub post 12551 of 2026-05-08 lists six CVEs in the SEPPmail Secure E-Mail Gateway, scored from 6.9 to 9.3, with exploitation status unknown and vendor patches available since 2026-04-24 (NCSC-CH, 2026-05-08). SEPPmail's 15.0.4 release notes say test endpoints intended only for development had been left active in the beta GINA v2 web interface and are now removed (SEPPmail release notes). CVE-2026-44128 (9.3) is unauthenticated remote code execution through a parameter passed to Perl eval() and was already fixed in 15.0.2.1 (NCSC-CH, 2026-05-08) (InfoGuard Labs, 2026-05-18); CVE-2026-44126 (9.2), an insecure deserialization, was fixed in 15.0.3 (InfoGuard Labs, 2026-05-18), while NCSC-CH's advisory says the vulnerabilities were fixed in 15.0.4 (NCSC-CH, 2026-05-08); CVE-2026-44125 (9.3, missing authorization on GINA v2 endpoints), CVE-2026-44127 (8.8, file inclusion and arbitrary file deletion), CVE-2026-44129 (8.3, server-side template injection) and CVE-2026-7864 (6.9, exposure of sensitive information) were fixed in 15.0.4 (InfoGuard Labs, 2026-05-18); the scores are NCSC-CH's (NCSC-CH, 2026-05-08). The appliance is OpenBSD-based with Perl web applications, and self-registration, enabled by default, gives an attacker an authenticated session (InfoGuard Labs, 2026-05-18).

Updaterun 2026-05-20-a0f7b07factionscvesregionssectorssourcestagsbody

InfoGuard Labs, which found CVE-2026-2743 and the GINA v2 flaws, published its technical write-up on 2026-05-18 (InfoGuard Labs, 2026-05-18). CVE-2026-2743 (CVSS 10.0 (The Hacker News, 2026-05-19)) is a pre-authentication path traversal in the Large File Transfer (LFT) component's /v1/file.app endpoint that writes files as the nobody user; because nobody can write /etc/syslog.conf, and newsyslog runs every 15 minutes and makes syslogd reload its configuration, the write becomes command execution (InfoGuard Labs, 2026-05-18). Only instances with LFT, which InfoGuard says most customers enable, are affected; /v1/file.app returning HTTP 404 means not affected (InfoGuard Labs, 2026-05-18). CVE-2026-2743 is not new: SEPPmail's 15.0.3 release notes already close it (SEPPmail release notes). The Hacker News reported the write-up (The Hacker News, 2026-05-19).

Contradiction: SEPPmail's release notes place the CVE-2026-2743 fix in 15.0.3 (SEPPmail release notes), while InfoGuard's table lists 15.0.4 (InfoGuard Labs, 2026-05-18); 15.0.4 or later covers both readings. InfoGuard also places the CVE-2026-44126 fix in 15.0.3 (InfoGuard Labs, 2026-05-18), while NCSC-CH's advisory says the vulnerabilities were fixed in 15.0.4 (NCSC-CH, 2026-05-08), so 15.0.4 is the safe floor for that flaw too.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarysectorstagscvesaffected_productstechniquessourcesverificationclassificationactionsbody

The fixes arrived across three releases: CVE-2026-44128 in 15.0.2.1, CVE-2026-44126 in 15.0.3 and the remaining four GINA v2 flaws in 15.0.4; 15.0.4.1 is an unrelated hotfix (InfoGuard Labs, 2026-05-18) (SEPPmail release notes). CVE-2026-2743 was closed in SEPPmail's 15.0.3 release, so it was not new in May; InfoGuard's May write-up gives 15.0.4 as its fix version (SEPPmail release notes) (InfoGuard Labs, 2026-05-18). CVE-2026-7864 exposes sensitive information and CVE-2026-44127 allows file inclusion and deletion; neither is code execution (InfoGuard Labs, 2026-05-18). SEPPmail AG is based in Neuenhof, not Steinach (SEPPmail).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: NCSC-CH · SEPPmail release notes · InfoGuard Labs · The Hacker News · SEPPmail · CybersecurityNews

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cybersecuritynews.com1 (17%)
  • downloads.seppmail.com1 (17%)
  • labs.infoguard.ch1 (17%)
  • security-hub.ncsc.admin.ch1 (17%)
  • seppmail.com1 (17%)
  • thehackernews.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)