# SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424) · pwn.watch > SEPPmail's 15.1.1 patch release (Oct 27 2026) fixes five CVEs in Secure Email Gateway before 15.1.1. The worst are CVE-2026-114424 and CVE-2026-114425 (both CVSS 9.2): an unauthenticated remote sender can execute OS commands as root when an active address-replacement rule uses message-derived replacement text evaluated as Perl, and crafted Large File Transfer attachment metadata can make the root mail worker read, move or delete accessible files when LFT is enabled. Also fixed: pre-auth upload resource exhaustion (CVE-2026-114426, 8.7), GINA LDAP account enumeration (CVE-2026-114420, 8.3) and GINA empty-password recovery takeover (CVE-2026-114421, 6.9). CVE records appeared around Nov 4 2026. Upgrade appliances (including HIN Mailgateway builds on the same firmware) to 15.1.1. Page: https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424 · generated 2026-11-04T14:30:54.317Z ## Status - Severity: critical · status: live · patch: patched - Product: SEPPmail Secure Email Gateway (SEG) - Started: 2026-10-27 - CVEs: CVE-2026-114424, CVE-2026-114425, CVE-2026-114426, CVE-2026-114420, CVE-2026-114421 - Affected: SEPPmail Secure Email Gateway before 15.1.1 - Fixed in: 15.1.1 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/feed.xml - JSON Feed: https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424.json - This file: https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424/llms.txt ## Updates (newest first) - 2026-11-04: CVE-2026-114424 and related SEPPmail CVEs appear in public vulnerability databases describing unauthenticated root code execution and LFT file access before 15.1.1. (https://www.rapid7.com/db/vulnerabilities/cve-2026-114424/) - 2026-10-27: SEPPmail publishes patch release 15.1.1 fixing CVE-2026-114424/114425 (9.2), 114426 (8.7), 114420 (8.3) and 114421 (6.9), plus a DNS regression from 15.1.0.1. (https://docs.seppmail.com/en/20_revision-history.html) ## Fix brief # Security brief: SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424) Source: https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424 · status: live · severity: critical · updated Nov 4, 2026, 14:24 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is SEPPmail's 15.1.1 patch release (Oct 27 2026) fixes five CVEs in Secure Email Gateway before 15.1.1. The worst are CVE-2026-114424 and CVE-2026-114425 (both CVSS 9.2): an unauthenticated remote sender can execute OS commands as root when an active address-replacement rule uses message-derived replacement text evaluated as Perl, and crafted Large File Transfer attachment metadata can make the root mail worker read, move or delete accessible files when LFT is enabled. Also fixed: pre-auth upload resource exhaustion (CVE-2026-114426, 8.7), GINA LDAP account enumeration (CVE-2026-114420, 8.3) and GINA empty-password recovery takeover (CVE-2026-114421, 6.9). CVE records appeared around Nov 4 2026. Upgrade appliances (including HIN Mailgateway builds on the same firmware) to 15.1.1. Severity detail: CVSS 9.2 unauthenticated root command execution via address-replacement rules; paired 9.2 LFT arbitrary file access; no known exploitation at disclosure - Product: SEPPmail Secure Email Gateway (SEG) - CVE / advisory ids: CVE-2026-114424, CVE-2026-114425, CVE-2026-114426, CVE-2026-114420, CVE-2026-114421 ## Affected versions - SEPPmail Secure Email Gateway before 15.1.1 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 15.1.1 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Upgrade every SEPPmail / HIN Mailgateway appliance to 15.1.1. Until then, review address-replacement rules that use message-derived values, and consider disabling LFT and external GINA password recovery if exposed. ## Latest updates - Nov 4, 2026: CVE-2026-114424 and related SEPPmail CVEs appear in public vulnerability databases describing unauthenticated root code execution and LFT file access before 15.1.1. - Oct 27, 2026: SEPPmail publishes patch release 15.1.1 fixing CVE-2026-114424/114425 (9.2), 114426 (8.7), 114420 (8.3) and 114421 (6.9), plus a DNS regression from 15.1.0.1. ## Advisories - [SEPPmail Revision History — Patch release 15.1.1](https://docs.seppmail.com/en/20_revision-history.html) (SEPPmail AG) - [CVE-2026-114424 (Rapid7)](https://www.rapid7.com/db/vulnerabilities/cve-2026-114424/) (Rapid7) --- Machine-readable: https://pwn.watch/i/seppmail-secure-email-gateway-cve-2026-114424.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.