Critical SEPPmail Vulnerabilities Allow RCE, Data Theft

Key Takeaways

• Multiple critical vulnerabilities, including remote code execution (RCE) and data theft, have been discovered in the SEPPmail Secure Email Gateway.
• The flaws impact SEPPmail appliances running versions prior to the 15.x branch, particularly affecting organizations in the DACH region.
• The most severe vulnerability, CVE-2026-2743, allows unauthenticated RCE via path traversal in the Large File Transfer (LFT) component.
• Successful exploitation could lead to full system control, interception of encrypted emails, and access to sensitive credentials.
• Patched versions in the 15.x branch (e.g., 15.0.4 or later) are available, and immediate upgrades are strongly recommended.

The SEPPmail Secure Email Gateway, a solution widely adopted for secure email communication, has been found to contain several critical vulnerabilities. These flaws could allow attackers to execute arbitrary code remotely and potentially intercept highly sensitive email traffic, posing a significant risk to affected organizations.

Security researchers have identified a series of high-impact weaknesses within the SEPPmail appliances, which are extensively deployed, particularly across Germany, Austria, and Switzerland (DACH region).

The most pressing issues include:

• CVE-2026-2743: A pre-authenticated remote code execution vulnerability stemming from an arbitrary file write flaw in the Large File Transfer (LFT) module.
• CVE-2026-44128: An unauthenticated remote code execution vulnerability achievable through Perl code injection.
• CVE-2026-44127: A Local File Inclusion (LFI) vulnerability that permits unauthorized access to sensitive system files and email content.
• CVE-2026-7864: An issue exposing sensitive environment variables without requiring authentication.

These vulnerabilities are present in SEPPmail versions preceding the patched releases within the 15.x branch.

SEPPmail Gateway Flaws

Path Traversal Leads to Full RCE

The most critical of the identified vulnerabilities, CVE-2026-2743, resides within the Large File Transfer (LFT) feature, which is designed to manage substantial email attachments. The core problem lies in the backend’s failure to adequately sanitize user-provided file paths during the upload process. This oversight enables attackers to leverage directory-traversal sequences, such as “../”, to write files outside their designated directories.

Researchers demonstrated the potential for exploitation by showing how attackers could overwrite the /etc/syslog.conf system file, which is accessible to the low-privileged “nobody” user. By injecting malicious configuration entries into syslog, an attacker can compel the system to execute arbitrary commands. For instance, a carefully crafted payload could trigger a reverse shell when system logs are processed.

The attack chain culminates when log rotation, managed by newsyslog, reloads the altered configuration. This action effectively executes the malicious code without requiring any prior authentication.

GINA V2 Vulnerabilities

The more recent GINA V2 web interface introduces additional severe security concerns:

• Perl Injection (CVE-2026-44128): This flaw arises from unsanitized input being directly passed to a Perl eval() function, enabling full command execution.
• LFI and Arbitrary File Access (CVE-2026-44127): Attackers can exploit this to read sensitive files, including LDAP databases, email content, and system credentials.
• Debug Exposure (CVE-2026-7864): Unauthenticated endpoints inadvertently leak environment variables, providing valuable information that can facilitate further exploitation.

A significant concern is that some of these endpoints lack proper authentication checks, drastically reducing the effort required for attackers to initiate exploitation. Successful exploitation of these vulnerabilities could grant attackers comprehensive control over the email gateway, allowing them to intercept, read, or alter encrypted email traffic. Furthermore, it could expose credentials, cryptographic keys, and internal communications, potentially establishing persistent access within an organization’s network.

Given that SEPPmail appliances frequently operate as black-box virtual systems, internal security teams may have limited visibility into potential ongoing attacks, making detection particularly challenging. As research published by Infoguard Labs highlights, even seemingly robust secure email solutions can harbor critical vulnerabilities, underscoring the necessity of continuous vigilance and patching. The researchers also noted the increasing acceleration of vulnerability discovery and exploitation, partly attributed to the growing role of AI-assisted tools.

What You Should Do

• Upgrade Immediately: Apply the latest patched versions, specifically 15.0.4 or newer, where applicable, as soon as possible.
• Disable Unused Features: If not essential for your operations, disable features like Large File Transfer (LFT) and GINA V2 to reduce the attack surface.
• Restrict Access: Implement strict access controls for any exposed API endpoints associated with the SEPPmail gateway.
• Monitor Logs: Actively monitor system logs for any unusual activity, suspicious file writes, or forced log rotations that could indicate compromise.
• Conduct Audits: Perform internal security audits to identify any potential existing compromises or unauthorized access within your network.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.