PT-2026-38960 · Unknown · Seppmail Secure Email Gateway

Dario Weiss · Published 2026-05-08 · Updated 2026-05-18 · CVE-2026-44128

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SEPPmail Secure Email Gateway versions prior to 15.0.2.1

Description The new GINA UI allows unauthenticated remote code execution. This occurs because an endpoint passes attacker-controlled input from a parameter to the Perl eval() function, which executes arbitrary code.

Recommendations Update to version 15.0.2.1.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-44128

Affected Products

Seppmail Secure Email Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44128 · Security Note
• https://twitter.com/InfoGuard_Labs/status/2056379180783112420 · Twitter Post
• https://twitter.com/CVEnew/status/2053174621269049663 · Twitter Post
• https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security · Note
• https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128 · Note