SEPPmail Secure Email Gateway CVE-2026-44127

Remote exploitation against default configurations of SEPPmail Secure Email Gateway with the /api.app/attachment/preview API endpoint exposed to attacker-reachable networks. No authentication, user interaction, or non-default configuration required - the CVSS vector (CVSS:4.0/AV:N/AC:L/PR:N/UI:N) confirms zero-condition remote unauthenticated exploitation. However, exploitation IS limited by network accessibility - appliances deployed behind authenticated mail relay infrastructure or restricted to internal VLANs significantly reduce attack surface compared to direct internet exposure. File access scope is bounded by api.app process privileges, which typically exceed least-privilege principles for email processing services but may not extend to full root filesystem access depending on SEPPmail's service isolation architecture.

High real-world risk driven by multiple converging factors. CVSS 4.0 score of 8.8 with attack vector network (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) indicates trivial exploitation against any internet-facing instance. The vulnerability provides both information disclosure (VC:H - high confidentiality impact) and file manipulation capabilities (VI:L/VA:L - low integrity/availability impact), enabling attackers to exfiltrate email content, encryption keys, LDAP credentials, or TLS certificates, then selectively delete evidence or destabilize the system. Email gateways are high-value perimeter targets often exposed to the internet by design. However, exploitation probability is tempered by the appliance's specialized deployment context - enterprises typically limit SEPPmail exposure to mail servers rather than general internet traffic. EPSS score not provided in input data, limiting quantitative exploitation likelihood assessment. No CISA KEV listing suggests targeted rather than widespread exploitation. The Swiss NCSC attribution indicates professional security research disclosure rather than underground exploit marketplace activity. Priority remediation recommended for internet-facing deployments; moderate urgency for internal-only instances behind authenticated mail relay infrastructure.

An external attacker scans for SEPPmail appliances using Shodan or similar reconnaissance and identifies the /api.app/attachment/preview endpoint. They craft HTTP requests with path traversal payloads in the identifier parameter (e.g., ../../../../etc/passwd or ../../../seppmail/config/credentials.xml) to extract system files, email encryption keys, and administrative credentials without authentication. After mapping the file system, the attacker triggers deletion of audit logs or configuration backups by exploiting the same endpoint's file cleanup logic, then uses exfiltrated credentials for persistent access to email communications or lateral movement into connected Active Directory infrastructure.