CVE-2026-114424 · Infrastructure
NO FIX YET · SEE WHAT TO DO
SEPPmail Secure Email Gateway before 15.1.1 evaluates attacker-influenced replacement text as Perl code in sender and recipient replacement rules. An unauthenticated remote sender can run operating-system commands in the mail-processing worker, which the sources say ran as root.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organisations running SEPPmail Secure Email Gateway before 15.1.1 with active sender or recipient replacement rules that use message-derived replacement data. The exposure depends on the rule configuration and whether a search condition matches. Installations on 15.1.1 or later, or without such rules, are not described as affected.
Not affected if no-active-replacement-rules, version-15.1.1-or-later
Who cares email-gateway, perl, seppmail
15.1.1 is the first fixed version).15.1.1 or later.SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
This page as .md · .json · in your agent: get_signal("CVE-2026-114424") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.