What is the CVSS score of CVE-2026-27442?

CVE-2026-27442 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Seppmail are affected by CVE-2026-27442?

CVE-2026-27442 affects SEPPmail Secure Email Gateway versions prior to 15.0.1, allowing attackers to bypass attachment filename validation and access files on the gateway.

How to fix or mitigate CVE-2026-27442?

Within 24 hours: Inventory all SEPPmail gateway deployments and identify versions below 15.0.1; document affected systems and notify security operations. Within 7 days: Implement network segmentation to restrict gateway access, enable verbose logging of attachment handling, and establish monitoring for suspicious file access patterns. Within 30 days: Upgrade to SEPPmail version 15.0.1 or later once released; if upgrade is not immediately feasible, evaluate alternative secure email solutions or implement WAF rules to filter suspicious attachment filenames.

Seppmail CVE-2026-27442

HIGH

Path Traversal (CWE-22)

2026-03-04 vulnerability@ncsc.ch

Path Traversal Seppmail

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.

AnalysisAI

Improper filename validation in SEPPmail Secure Email Gateway's GINA web interface (versions before 15.0.1) enables unauthenticated remote attackers to access arbitrary files on the gateway through specially crafted encrypted email attachments. This path traversal vulnerability affects the confidentiality of sensitive data stored on affected systems. No patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Seppmail. The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.