Which versions of SEPPmail Secure Email Gateway are affected by CVE-2026-44128?

SEPPmail Secure Email Gateway versions before 15.0.2.1 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands through the GINA UI,…. A patch is available.

How to fix or mitigate CVE-2026-44128?

Within 24 hours: Identify all SEPPmail deployments and their current versions via asset inventory; isolate or air-gap systems running versions prior to 15.0.2.1 from untrusted networks if possible. Within 7 days: Upgrade all affected instances to version 15.0.2.1 or later per SEPPmail vendor guidance; validate upgrades in non-production environment first. Within 30 days: Conduct forensic review of logs for GINA UI access attempts and Perl eval execution patterns; implement network segmentation to restrict GINA UI access to authorized administrators only.

SEPPmail Secure Email Gateway CVE-2026-44128

Q: What is the CVSS score of CVE-2026-44128?

CVE-2026-44128 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-28588 CRITICAL

Eval Injection (CWE-95)

2026-05-08 NCSC.ch

GHSA-qwq6-r6c6-68jr

Code Injection RCE Secure Email Gateway

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 08, 2026 - 14:33 EUVD

Analysis Generated

May 08, 2026 - 14:31 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

9.3 (CRITICAL)

CVE Published

May 08, 2026 - 13:13 nvd

CRITICAL 9.3

DescriptionCVE.org

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.

AnalysisAI

Remote code execution in SEPPmail Secure Email Gateway versions prior to 15.0.2.1 enables unauthenticated attackers to execute arbitrary Perl code via the GINA UI. The vulnerability stems from an endpoint passing unsanitized user input directly to Perl's eval function, allowing complete system compromise. Reported by Switzerland's national CERT (NCSC.ch), this represents a critical pre-authentication attack surface requiring immediate patching.

Technical ContextAI

The vulnerability exploits Perl's eval function, which dynamically executes arbitrary code passed as strings. The new GINA UI (likely SEPPmail's Generation-Integrated Next Architecture interface) contains an endpoint that fails to sanitize attacker-controlled parameter input before passing it to eval. This is a textbook CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) vulnerability. When untrusted data flows directly into eval without validation, attackers can inject malicious Perl commands that execute with the privileges of the web application process. This affects SEPPmail Secure Email Gateway (cpe:2.3:a:seppmail_ag:secure_email_gateway), an enterprise email security appliance handling message filtering, encryption, and threat detection for organizations.

RemediationAI

Upgrade to SEPPmail Secure Email Gateway version 15.0.2.1 or later immediately, as documented in the vendor's external release notes at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security. Given the unauthenticated remote code execution nature, this should be treated as an emergency patch cycle. If immediate patching is not feasible, implement network-level access restrictions to the GINA UI: restrict access to the vulnerable endpoint to trusted management networks only via firewall rules or reverse proxy controls, blocking all internet-facing access. Identify the specific GINA UI URL paths and apply allowlist-based access control. Monitor authentication logs and web server access logs for unusual POST/GET requests to GINA endpoints, particularly those containing Perl code patterns (system, exec, backticks, pipe operators). Note that access restrictions are temporary mitigations only and introduce operational overhead for legitimate remote administration - plan for rapid patch deployment within 24-48 hours of detection.