SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access

Seven critical vulnerabilities in SEPPMail Secure E-Mail Gateway enable remote code execution and unauthorized mail access.

• •CVE-2026-2743 (CVSS 10.0): Path traversal in LFT feature allows RCE via syslog configuration manipulation.
• •CVE-2026-7864 (CVSS 6.9): Unauthenticated endpoint in GINA UI leaks environment variables and system information.
• •CVE-2026-44128 (CVSS 9.3): Eval injection in /api.app/template enables unauthenticated remote code execution.
• •Additional authorization bypass and deserialization vulnerabilities in GINA UI and API endpoints.

This summary was automatically generated by AI based on the original article and may not be fully accurate.