SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424)
SEPPmail Secure Email Gateway (SEG)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
SEPPmail's 15.1.1 patch release (Oct 27 2026) fixes five CVEs in Secure Email Gateway before 15.1.1. The worst are CVE-2026-114424 and CVE-2026-114425 (both CVSS 9.2): an unauthenticated remote sender can execute OS commands as root when an active address-replacement rule uses message-derived replacement text evaluated as Perl, and crafted Large File Transfer attachment metadata can make the root mail worker read, move or delete accessible files when LFT is enabled. Also fixed: pre-auth upload resource exhaustion (CVE-2026-114426, 8.7), GINA LDAP account enumeration (CVE-2026-114420, 8.3) and GINA empty-password recovery takeover (CVE-2026-114421, 6.9). CVE records appeared around Nov 4 2026. Upgrade appliances (including HIN Mailgateway builds on the same firmware) to 15.1.1.
Why this severity: CVSS 9.2 unauthenticated root command execution via address-replacement rules; paired 9.2 LFT arbitrary file access; no known exploitation at disclosure
- Started
- Oct 27, 2026
Affected
- SEPPmail Secure Email Gateway before 15.1.1
Fixed in
- 15.1.1
Timeline2
CVE-2026-114424 and related SEPPmail CVEs appear in public vulnerability databases describing unauthenticated root code execution and LFT file access before 15.1.1.
SEPPmail publishes patch release 15.1.1 fixing CVE-2026-114424/114425 (9.2), 114426 (8.7), 114420 (8.3) and 114421 (6.9), plus a DNS regression from 15.1.0.1.
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
