PT-2026-39002 · Seppmail · Seppmail Secure Email Gateway

Dario Weiss · Published 2026-05-08 · Updated 2026-05-19 · CVE-2026-44126

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SEPPmail Secure Email Gateway versions prior to 15.0.4

Description Insecure deserialization of untrusted data occurs within the new GINA UI. This flaw allows unauthenticated remote attackers to execute arbitrary code by sending a specially crafted serialized object.

Recommendations Update to version 15.0.4 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-44126

Affected Products

Seppmail Secure Email Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-44126 · Security Note
• https://twitter.com/CVEnew/status/2053174614025486829 · Twitter Post
• https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security · Note
• https://reddit.com/r/pwnhub/comments/1thlur8/seppmail_secure_email_gateway_faces_major · Reddit Post
• https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128 · Note