SEPPmail AG has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 5. The median CVSS is 8.6 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: SEPPmail Secure Email Gateway (SEG) (7), Secure Email Gateway (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Products
- SEPPmail Secure Email Gateway (SEG) 7
- Secure Email Gateway 1
Worst active — by depth score
CVE-2026-114425Critical· 9.2Forged LFT metadata permits arbitrary file read and deletion51CVE-2026-114424Critical· 9.2Code execution through double evaluation in address replacement rules51CVE-2026-114426High· 8.7Pre-authentication upload parsing permits resource exhaustion48CVE-2026-84830High· 8.6OS command injection in privileged configuration handling48CVE-2026-84832High· 8.6Unsafe deserialization in the REST interface47
SEPPmail AG vulnerabilities
CVEs affecting SEPPmail AG, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-114421High· 8.3Empty initial password permits GINA account takeover
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies su…
CVE-2026-114425Critical· 9.2Forged LFT metadata permits arbitrary file read and deletion
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an…
CVE-2026-114424Critical· 9.2Code execution through double evaluation in address replacement rules
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-proce…
CVE-2026-114420Medium· 6.9LDAP wildcard injection exposes GINA recipient accounts
SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.
CVE-2026-114426High· 8.7Pre-authentication upload parsing permits resource exhaustion
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume…
CVE-2026-84830High· 8.6OS command injection in privileged configuration handling
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
CVE-2026-84832High· 8.6Unsafe deserialization in the REST interface
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" priv…
CVE-2026-84831High· 7.7Mandatory MFA bypass before enrollment
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access prote…