Which versions of SEPPmail Secure Email Gateway are affected by CVE-2026-44127?

CVE-2026-44127 affects SEPPmail Secure Email Gateway versions before 15.0.4, allowing unauthenticated remote attackers to read arbitrary files and delete targeted files through a path traversal flaw…. A patch is available.

How to fix or mitigate CVE-2026-44127?

Within 24 hours: Identify all SEPPmail Secure Email Gateway appliances in your environment and document current versions; isolate or restrict network access to the /api.app/attachment/preview endpoint if immediate patching is not feasible. Within 7 days: Upgrade all affected instances to SEPPmail version 15.0.4 or later; verify patch deployment across all gateways. Within 30 days: Conduct forensic review of gateway logs for suspicious attachment preview requests; rotate any credentials stored on affected appliances; perform configuration file integrity checks.

SEPPmail Secure Email Gateway CVE-2026-44127

Q: What is the CVSS score of CVE-2026-44127?

CVE-2026-44127 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28587 HIGH

External Control of File Name or Path (CWE-73)

2026-05-08 NCSC.ch

GHSA-gh4w-5vrf-hhcg

Path Traversal Secure Email Gateway

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 08, 2026 - 14:33 EUVD

Analysis Generated

May 08, 2026 - 14:30 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 08, 2026 - 13:13 nvd

HIGH 8.8

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

AnalysisAI

Remote unauthenticated attackers can read arbitrary local files and trigger deletion of targeted files in SEPPmail Secure Email Gateway versions before 15.0.4 through path traversal in the /api.app/attachment/preview endpoint. The vulnerability allows exploitation without authentication or user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), enabling attackers to exfiltrate sensitive configuration files, credentials, or email data, and selectively delete files with api.app process privileges. No active exploitation confirmed by CISA KEV at time of analysis, though the unauthenticated remote attack vector and file manipulation capabilities represent elevated risk for exposed email gateway appliances. Swiss NCSC disclosure suggests vendor-coordinated remediation.

Technical ContextAI

SEPPmail Secure Email Gateway is an email security appliance providing encryption, DLP, and threat protection. The vulnerability stems from CWE-73 (External Control of File Name or Path) in the identifier parameter of the /api.app/attachment/preview API endpoint. Path traversal flaws occur when user-supplied input containing directory traversal sequences (../ or absolute paths) is insufficiently validated before being used in file system operations. The affected CPE (cpe:2.3:a:seppmail_ag:secure_email_gateway) indicates the core appliance software is vulnerable. The api.app process context determines file access boundaries - typically this service runs with elevated privileges to access email attachment stores and system configuration directories. The dual impact (read arbitrary files AND trigger deletion) suggests the endpoint performs both file retrieval and cleanup operations on the same user-controlled path parameter without proper canonicalization or sandboxing.

RemediationAI

Upgrade to SEPPmail Secure Email Gateway version 15.0.4 or later per vendor advisory at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security. For environments unable to immediately patch, implement compensating controls: (1) Restrict network access to /api.app/* endpoints to authenticated administrative IPs only via firewall rules or reverse proxy ACLs - note this breaks legitimate attachment preview for unauthorized networks; (2) Deploy web application firewall rules to block requests containing path traversal sequences (../, ..\ , %2e%2e%2f, absolute paths) in the identifier parameter - may cause false positives with legitimate attachment filenames containing periods; (3) Monitor api.app process file access via auditd or equivalent for unexpected reads outside /var/seppmail/attachments or similar designated paths - generates high log volume requiring SIEM tuning. Temporary API endpoint disablement is not documented by vendor and may break core email processing workflows. Patch deployment remains the only complete remediation without operational trade-offs.