SEPPmail vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-84832 SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation.High 8.6 · Sep 3, 2026
• CVE-2026-84831 SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed.High 7.7 · Sep 3, 2026
• CVE-2026-84830 SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevateHigh 8.6 · Sep 3, 2026
• CVE-2026-9592 SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the sessiHigh 7.5 · Jul 17, 2026
• CVE-2026-8811 SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation.High 7.1 · Jun 18, 2026
• CVE-2026-44129 SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacHigh 8.3 · May 8, 2026
• CVE-2026-44128 SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controCritical 9.3 · May 8, 2026
• CVE-2026-44127 SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/High 8.8 · May 8, 2026
• CVE-2026-44126 SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticaCritical 9.2 · May 8, 2026
• CVE-2026-44125 SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated reCritical 9.3 · May 8, 2026
• CVE-2026-29144 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike charactersHigh 7.8 · Apr 2, 2026
• CVE-2026-29143 SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to High 7.8 · Apr 2, 2026
• CVE-2026-29141 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK].High 7.7 · Apr 2, 2026
• CVE-2026-29140 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim byHigh 7.7 · Apr 2, 2026
• CVE-2026-29139 SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.High 7.8 · Apr 2, 2026
• CVE-2026-2743 Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface.Critical 10 · Mar 5, 2026
• CVE-2026-2748 SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signatuHigh 7.8 · Mar 4, 2026
• CVE-2026-27444 SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mHigh 7.8 · Mar 4, 2026
• CVE-2026-27443 SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control High 8.2 · Mar 4, 2026
• CVE-2026-27442 The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing anCritical 9.3 · Mar 4, 2026
• CVE-2026-27441 SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.Critical 9.5 · Mar 4, 2026