What is the CVSS score of CVE-2026-27441?

CVE-2026-27441 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-27441?

Within 24 hours: Identify all SEPPmail deployments and versions in use; isolate affected systems from critical networks if version is below 15.0.1. Within 7 days: Implement network segmentation to restrict SEPPmail access; disable PDF handling features if operationally feasible; deploy IDS/IPS signatures to detect exploit attempts. Within 30 days: Upgrade all SEPPmail instances to version 15.0.1 or later; conduct forensic review of logs for signs of exploitation; perform security assessment post-remediation.

Seppmail CVE-2026-27441

CRITICAL

OS Command Injection (CWE-78)

2026-03-04 vulnerability@ncsc.ch

Command Injection Seppmail

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send email with crafted PDF attachment
Delivery

SEPPmail processes PDF with weak encryption
Exploit

Extract or bypass password
Execution

Inject OS commands
Impact

Execute arbitrary commands on gateway

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	SEPPmail Secure Email Gateway versions before 15.0.1 processing PDF attachments. No authentication required. Remote unauthenticated attackers can exploit default email processing against unpatched instances.
Impact	CVSS 9.8. Email gateway compromise exposes all processed emails.
Exploit ScenarioDerived	Inject commands through PDF encryption password.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Command injection in SEPPmail Secure Email Gateway before 15.0.1 via PDF encryption password.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:05 CVSS 9.8

Command injection in SEPPmail email gateway.

RemediationAI

Update to 15.0.1.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-78 via PDF encryption password field.

Know when Seppmail gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.

Executive ViewAI

Why It Matters

A critical vulnerability in SEPPmail Secure Email Gateway versions before 15.0.1 allows attackers to execute arbitrary OS commands by exploiting improper PDF encryption password handling. This directly threatens all organizations using affected SEPPmail versions, potentially enabling unauthorized access to email systems, data exfiltration, and lateral movement within the network.

Business Impact: Severe

Compensating Controls

Implement network segmentation to restrict SEPPmail system access; deploy Web Application Firewall (WAF) or IPS rules to detect and block suspicious PDF-related requests; disable PDF encryption features if not business-critical; restrict outbound connections from SEPPmail systems; implement strict input validation and monitoring on email gateway logs for command injection patterns; enforce multi-factor authentication for administrative access to SEPPmail; monitor for suspicious process execution originating from SEPPmail services.

Threat Intelligence Overview

EPSS Score

0.1%

Top 82% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.