CVE-2026-114424 and CVE-2026-114425, SEPPmail Secure Email Gateway before 15.1.1: an unauthenticated mail sender can reach root command execution through a replacement rule and root file access through Large File Transfer, with three more flaws fixed in the same release and no fix for the 15.0 branch (CVSS 4.0 9.2)
SEPPmail gateway: unauthenticated sender reaches root RCE or file access; fixed in 15.1.1, 15.0.x has no fix
Defender actions
- Upgrade every SEPPmail Secure Email Gateway to 15.1.1 now, moving 15.0.x gateways to the 15.1 branch because 15.0.7 is the last 15.0 release, and check each gateway's active address-replacement rules for values taken from the message and its Large File Transfer setting, the two conditions the CNA names.
Analysis
SEPPmail's revision history lists patch release 15.1.1 of 2026-11-03 with five security fixes in the Secure Email Gateway, all for versions before 15.1.1 (SEPPmail, 2026-11-03). Two are unauthenticated and rated 9.2: in CVE-2026-114424 attacker-influenced replacement text in sender or recipient address-replacement rules is evaluated as Perl code, so a remote sender can run operating-system commands in the mail-processing worker when an active rule uses message-derived replacement data and its search condition matches, and the validated worker context was root (ENISA EUVD, 2026-11-04); in CVE-2026-114425 a file path supplied in the attachment metadata of an incoming message lets the worker disclose, move or delete an accessible file when Large File Transfer is enabled, also as root (ENISA EUVD, 2026-11-04). CVE-2026-114426 lets an unauthenticated attacker exhaust workers and disk because the upload interface processed data before checking authentication (ENISA EUVD, 2026-11-04), and two flaws in the GINA webmail let an unauthenticated attacker take over a created but unregistered account with an empty initial password (CVE-2026-114421) and enumerate email addresses through an unescaped LDAP filter (CVE-2026-114420) (ENISA EUVD, 2026-11-04; ENISA EUVD, 2026-11-04). The vendor says 15.0.7 of 2026-09-02 is the last release of the 15.0 branch, so the fix for a 15.0.x gateway is the move to 15.1 (SEPPmail, 2026-11-03). None of the sources read reports exploitation.
Cited evidence
An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
This release will be the last release in the 15.0 branch and enable the update to version 15.1.
Sources7
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.