{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424) · updates",
  "home_page_url": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424",
  "feed_url": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/feed.json",
  "description": "SEPPmail's 15.1.1 patch release (Oct 27 2026) fixes five CVEs in Secure Email Gateway before 15.1.1. The worst are CVE-2026-114424 and CVE-2026-114425 (both CVSS 9.2): an unauthenticated remote sender can execute OS commands as root when an active address-replacement rule uses message-derived replacement text evaluated as Perl, and crafted Large File Transfer attachment metadata can make the root mail worker read, move or delete accessible files when LFT is enabled. Also fixed: pre-auth upload resource exhaustion (CVE-2026-114426, 8.7), GINA LDAP account enumeration (CVE-2026-114420, 8.3) and GINA empty-password recovery takeover (CVE-2026-114421, 6.9). CVE records appeared around Nov 4 2026. Upgrade appliances (including HIN Mailgateway builds on the same firmware) to 15.1.1.",
  "language": "en",
  "_pwn": {
    "slug": "seppmail-secure-email-gateway-cve-2026-114424",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/feed.xml",
    "llms": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/llms.txt",
    "json": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424#2026-11-04-6a3359ff",
      "url": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424#2026-11-04-6a3359ff",
      "title": "SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424): CVE-2026-114424 and related SEPPmail CVEs appear in public vulnerability databases describing unauthenticated root code execution and LFT file access before 15.1.1.",
      "content_text": "SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424): CVE-2026-114424 and related SEPPmail CVEs appear in public vulnerability databases describing unauthenticated root code execution and LFT file access before 15.1.1.\n\nSource: https://www.rapid7.com/db/vulnerabilities/cve-2026-114424/",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.rapid7.com/db/vulnerabilities/cve-2026-114424/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424#2026-10-27-32a5f2c0",
      "url": "https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424#2026-10-27-32a5f2c0",
      "title": "SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424): SEPPmail publishes patch release 15.1.1 fixing CVE-2026-114424/114425 (9.2), 114426 (8.7), 114420 (8.3) and 114421 (6.9), plus a DNS regression from 15.1.0.1.",
      "content_text": "SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424): SEPPmail publishes patch release 15.1.1 fixing CVE-2026-114424/114425 (9.2), 114426 (8.7), 114420 (8.3) and 114421 (6.9), plus a DNS regression from 15.1.0.1.\n\nSource: https://docs.seppmail.com/en/20_revision-history.html",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://docs.seppmail.com/en/20_revision-history.html",
      "tags": [
        "critical"
      ]
    }
  ]
}