SeppMail CVE-2026-2743

The attacker needs network reachability to the SeppMail User Web Interface (typically TCP/443 on the gateway) with the Large File Transfer (LFT) feature enabled - LFT is the specific vulnerable module, so deployments that have disabled or never enabled LFT are not exposed via this CVE. No authentication, no user interaction, and no special client-side configuration are required (PR:N/UI:N/AT:N), and the issue affects SeppMail 15.0.2.1 and all prior versions running on any supported platform. Limiting factors are therefore narrow: only the LFT feature being disabled, the User Web Interface being firewalled off from the attacker's source network, or the appliance already running a post-15.0.2.1 fixed build will prevent exploitation.

Every authoritative severity signal is at the top of the scale: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system impacts SC:H/SI:H/SA:H, scored 10.0, meaning remote, low-complexity, unauthenticated, no-user-interaction exploitation with total compromise of confidentiality, integrity, and availability and proven propagation to adjacent systems. The AU:Y flag indicates the issue is automatable, and 'E:A' in the supplemental metrics signals that exploitation is attacked/available in the wild per the reporter, although CISA KEV has not (yet) listed it. Contrast this with EPSS at only 0.52% (67th percentile), which suggests the model has not seen mass scanning yet - consistent with SeppMail's relatively niche, enterprise-only footprint rather than absence of risk. The vulnerability is not on CISA KEV at time of analysis and no public exploit identified at time of analysis, but given that SeppMail gateways typically sit at the email perimeter and process untrusted inbound content, real-world risk to any exposed deployment should be treated as critical and time-sensitive regardless of the modest EPSS number.

An external attacker locates an internet-exposed SeppMail user portal via Shodan or passive DNS, then sends a crafted multipart upload to the Large File Transfer endpoint with a filename containing traversal sequences that places a server-executable file (such as a PHP, Perl, or shell script consumed by a scheduled task) into a directory served by the appliance's web stack. Requesting that file - or waiting for the privileged process to consume it - yields command execution as the gateway service account, giving the attacker a foothold inside the mail perimeter and access to plaintext encrypted-mail material. No public exploit identified at time of analysis, but the InfoGuard Labs advisory demonstrates feasibility and the CVSS AC:L/AT:N/PR:N/UI:N vector means a working exploit is straightforward to develop.