PT-2026-38961 · Unknown · Seppmail Secure Email Gateway

Dario Weiss · Published 2026-05-08 · Updated 2026-06-05 · CVE-2026-44129

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SEPPmail Secure Email Gateway versions prior to 15.0.4

Description The new GINA UI contains a server-side template injection (SSTI)—a flaw where an application embeds user input into a server-side template without proper validation—because an endpoint accepts attacker-controlled templates. This allows remote attackers to execute arbitrary template expressions, which may lead to remote code execution depending on the enabled template plugins.

Recommendations Update to version 15.0.4 or later.

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-44129

Affected Products

Seppmail Secure Email Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44129 · Security Note
• https://twitter.com/integ_sec/status/2062916301631131952 · Twitter Post
• https://twitter.com/CVEnew/status/2053174619025100915 · Twitter Post
• https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security · Note
• https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128 · Note