Seppmail Secure Email Gateway Seg
Monthly
Arbitrary OS command execution in SEPPmail Secure Email Gateway before 15.0.6 is possible via CWE-502 deserialization in the privileged REST API import workflow. An attacker who holds a privileged API token can submit a crafted serialized payload to the import endpoint and trigger command execution under the 'nobody' system account. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the attack pattern for deserialization vulnerabilities is well understood.
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.
Arbitrary OS command execution in SEPPmail Secure Email Gateway before 15.0.6 is possible via CWE-502 deserialization in the privileged REST API import workflow. An attacker who holds a privileged API token can submit a crafted serialized payload to the import endpoint and trigger command execution under the 'nobody' system account. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the attack pattern for deserialization vulnerabilities is well understood.
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.