EUVD-2026-28588
GHSA-qwq6-r6c6-68jr
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionNVD
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.
AnalysisAI
Remote code execution in SEPPmail Secure Email Gateway versions prior to 15.0.2.1 enables unauthenticated attackers to execute arbitrary Perl code via the GINA UI. The vulnerability stems from an endpoint passing unsanitized user input directly to Perl's eval function, allowing complete system compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all SEPPmail deployments and their current versions via asset inventory; isolate or air-gap systems running versions prior to 15.0.2.1 from untrusted networks if possible. Within 7 days: Upgrade all affected instances to version 15.0.2.1 or later per SEPPmail vendor guidance; validate upgrades in non-production environment first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today