Seppmail
Security incidents tagged Seppmail. Newest first.
1 Seppmail incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 8
- Longest quiet run: 7 days (Oct 28–Nov 3)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
SEPPmail Secure Email Gateway: unauthenticated root command execution via address rules (CVE-2026-114424)
SEPPmail's 15.1.1 patch release (Oct 27 2026) fixes five CVEs in Secure Email Gateway before 15.1.1. The worst are CVE-2026-114424 and CVE-2026-114425 (both CVSS 9.2): an unauthenticated remote sender can execute OS commands as root when an active address-replacement rule uses message-derived replacement text evaluated as Perl, and crafted Large File Transfer attachment metadata can make the root mail worker read, move or delete accessible files when LFT is enabled. Also fixed: pre-auth upload resource exhaustion (CVE-2026-114426, 8.7), GINA LDAP account enumeration (CVE-2026-114420, 8.3) and GINA empty-password recovery takeover (CVE-2026-114421, 6.9). CVE records appeared around Nov 4 2026. Upgrade appliances (including HIN Mailgateway builds on the same firmware) to 15.1.1.
SEPPmail Secure Email Gateway (SEG)Since Oct 27, 2026
