VulnSocial

CVE-2026-44128Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 3d ago at 1 mentions (2026-05-09); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-05-09: 1Mentions · 2026-05-18: 1Mentions · 2026-05-20: 1Mentions · 2026-05-26: 1Patch / Workaround · 2026-05-20: 1Technical Details · 2026-05-09: 1Technical Details · 2026-05-18: 1Technical Details · 2026-05-20: 1Technical Details · 2026-05-26: 105-0905-1805-2005-26
Signal classification1 categories
Disclosure
4100.0%
Referenced assets3 URLs
Full discourse4 posts
  • InfoGuard Labs@InfoGuard_Labs
    Disclosure

    New research: We audited SEPPmail's virtual appliance & found critical issues. Our post covers CVE-2026-2743 (RCE via syslog.conf) & CVE-2026-44128 (Perl injection) that let attackers read all mails or compromise the appliance. -> https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/

    Post summary

    Researchers audited a SEPPmail virtual appliance and disclosed critical RCE and injection vulnerabilities, detailing their technical mechanisms but not providing PoC, exploitation tools, or patch information.

    116027143.7K
    299 followersView on X
  • iototsecnews@iototsecnews
    Disclosure

    SEPPmail Secure E-Mail Gateway に複数の脆弱性：認証不要の RCE とトラフィック傍受 https://iototsecnews.jp/2026/05/19/seppmail-gateway-flaws-expose-organizations-to-rce-and-email-traffic-interception/ 今回の脆弱性の原因は、システムへ渡されるデータのチェックが不十分だったことに起因します。たとえば、脆弱性 CVE-2026-2743 では、アップロードされるファイル名の検証が足りなかったため、本来は書き換えてはいけないシステムの設定ファイルが変更されてしまいます。また、脆弱性 CVE-2026-44128 では、外部からの入力データをそのままプログラムの命令として実行してしまう問題が引き起こされます。このように、ユーザーが入力したデータの安全性を確認せずに処理してしまうことが、リモートからの不正なコマンド実行 (RCE) などの深刻な危険につながります。ご利用のチームは、ご注意ください。 #CVE20262743 #CVE202644127 #CVE202644128 #CVE20267864 #SecureEMailGateway #SEPPmail #Vulnerability

    Post summary

    The article discloses that SEPPmail Secure Email Gateway has vulnerabilities (CVE-2026-2743, CVE-2026-44128) that allow remote code execution via inadequate input validation, without mentioning PoC, exploit code, or active attacks.

    0000059
    490 followersView on X
  • SHORT INFO@ShortInfoNews
    Disclosure

    Every unpatched SEPPmail Secure E-Mail Gateway can be remotely seized and all corporate email read. InfoGuard Labs disclosed 7 flaws May 19, including a CVSS 10.0 path traversal (CVE-2026-2743) and an unauthenticated Perl RCE (CVE-2026-44128). Patched in v15.0.4.

    Post summary

    InfoGuard Labs disclosed two critical flaws in SEPPmail Secure E-Mail Gateway—a path traversal (CVE‑2026‑2743) and an unauthenticated Perl RCE (CVE‑2026‑44128) rated CVSS 10.0— and the vendor has addressed them with patch v15.0.4.

    000004
    147 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-44128 SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled i… https://www.cve.org/CVERecord?id=CVE-2026-44128

    Post summary

    The post announces CVE-2026-44128, a SEPPmail Secure Email Gateway flaw enabling unauthenticated remote code execution via the GINA UI. No exploit details, PoC, or patch information are supplied.

    0000078
    57.5K followersView on X

Explore more

Back to dashboard