Which versions of SeppMail are affected by CVE-2026-2743?

A critical vulnerability in SeppMail's file transfer feature allows attackers to upload malicious files and execute arbitrary code on affected systems with a 9.8 CVSS severity rating.

How to fix or mitigate CVE-2026-2743?

Within 24 hours: Disable the Large File Transfer (LFT) feature in SeppMail if operationally feasible, or restrict access to trusted internal networks only. Within 7 days: Implement Web Application Firewall (WAF) rules to block path traversal patterns in upload requests and segment SeppMail systems from critical infrastructure. Within 30 days: Establish a continuous monitoring plan for vendor patch release, evaluate alternative secure file transfer solutions, and conduct forensic analysis for signs of exploitation.

SeppMail CVE-2026-2743

Q: What is the CVSS score of CVE-2026-2743?

CVE-2026-2743 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Path Traversal (CWE-22)

2026-03-05 vulnerability@ncsc.ch

RCE Path Traversal Seppmail

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 18, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 18, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

May 18, 2026 - 17:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before

AnalysisAI

Remote code execution in SeppMail secure email gateway versions 15.0.2.1 and earlier allows unauthenticated attackers to write arbitrary files via path traversal in the Large File Transfer (LFT) feature of the User Web Interface, leading to full system compromise. The flaw carries a maximum CVSS 4.0 score of 10.0 reflecting network-reachable, no-privilege exploitation with scope-changing impact, and was disclosed by InfoGuard Labs alongside CVE-2026-7864, CVE-2026-44127, and CVE-2026-44128. No public exploit identified at time of analysis and EPSS sits at 0.52% (67th percentile), so widespread automated abuse has not yet materialized despite the critical severity.

Technical ContextAI

SeppMail is a Swiss secure email gateway appliance that provides encryption, signing, and secure file exchange; the vulnerable component is the User Web Interface's Large File Transfer (LFT) module, which accepts uploads from end users to share oversized attachments outside normal SMTP limits. The root cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. Path Traversal): the upload handler fails to canonicalize or sanitize user-controlled filename or path components, allowing '../' sequences (or equivalent) to escape the intended storage directory and write files to attacker-chosen locations on the underlying filesystem. By placing an executable script, web shell, or configuration file into a location parsed by the web server or a privileged service, the attacker pivots the file write primitive into remote code execution. The affected CPE is cpe:2.3:a:seppmail:seppmail covering all versions up to and including 15.0.2.1.

RemediationAI

Upgrade SeppMail to a version newer than 15.0.2.1 per the vendor release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html; the InfoGuard Labs advisory at https://labs.infoguard.ch/advisories/seppmail also lists this CVE alongside CVE-2026-7864, CVE-2026-44127, and CVE-2026-44128, so apply the cumulative fixed release that addresses all four issues rather than cherry-picking. Patch available per vendor advisory, but an exact fixed version string is not given in the input data - confirm the target build number directly with SeppMail support before rollout. As compensating controls until patching is complete, restrict access to the User Web Interface (and specifically the LFT upload endpoint) to trusted source networks via firewall or reverse-proxy ACL, disable the Large File Transfer feature in the gateway configuration if it is not in active use (trade-off: end users lose the oversized-attachment workflow), and place the management/user interface behind a VPN or zero-trust proxy that enforces strong authentication; note that disabling LFT does not protect against the other three companion CVEs in the same advisory bundle.