CVE-2026-114421 · Infrastructure
NO FIX YET · SEE WHAT TO DO
SEPPmail Secure Email Gateway before 15.1.1 lets password recovery run for a created but unregistered GINA account that has an empty initial password, without adequately checking the person is the owner. A remote attacker who finds such an account can set its password, log in as it, and lock the intended recipient out until recovery.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organizations running SEPPmail Secure Email Gateway before 15.1.1 that use GINA accounts for recipients. Exposure depends on whether the gateway's recovery flow is reachable from the internet and whether unregistered accounts with empty initial passwords exist. Deployments already on 15.1.1 or later are not affected.
Not affected if version-15.1.1-or-later
Who cares email, secure-email-gateway, seppmail
15.1.1.15.1.1 or later.SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
This page as .md · .json · in your agent: get_signal("CVE-2026-114421") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.