{"id":"CVE-2026-114424","kind":"vulnerability","aliases":["CVE-2026-114424"],"related":[],"title":"SEPPmail Secure Email Gateway: sender-supplied text runs as Perl, executes OS commands","description":"SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.","summary":"SEPPmail Secure Email Gateway before 15.1.1 evaluates attacker-influenced replacement text as Perl code in sender and recipient replacement rules. An unauthenticated remote sender can run operating-system commands in the mail-processing worker, which the sources say ran as root.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","infrastructure","perl","seppmail"],"not_affected_if":["no-active-replacement-rules","version-15.1.1-or-later"],"how_to_check":"- Check the installed SEPPmail version against the range below (`15.1.1` is the first fixed version).\n- Review sender and recipient replacement rules for active rules that use message-derived replacement data with a matching search condition.","fix":"- SEPPmail Secure Email Gateway: move to `15.1.1` or later.","status":"open","published_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","triaged_at":"2026-11-04T09:26:48+00:00","updated_at":"2026-11-04T09:26:48+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T09:26:48Z","model":"claude-haiku-5-5","output":{"fix":"- SEPPmail Secure Email Gateway: move to `15.1.1` or later.","reach":"internet","title":"SEPPmail Secure Email Gateway: sender-supplied text runs as Perl, executes OS commands","impact":"high","summary":"SEPPmail Secure Email Gateway before 15.1.1 evaluates attacker-influenced replacement text as Perl code in sender and recipient replacement rules. An unauthenticated remote sender can run operating-system commands in the mail-processing worker, which the sources say ran as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["seppmail","email-gateway","perl"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote sender runs OS commands as root on the gateway.","analyst_note":"Confirm the exact affected rule conditions and whether the vendor advisory adds mitigations beyond upgrading; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114424 is the only source given.","how_to_check":"- Check the installed SEPPmail version against the range below (`15.1.1` is the first fixed version).\n- Review sender and recipient replacement rules for active rules that use message-derived replacement data with a matching search condition.","plain_action":"","needs_analyst":true,"not_affected_if":["version-15.1.1-or-later","no-active-replacement-rules"],"who_is_affected":"Organisations running SEPPmail Secure Email Gateway before 15.1.1 with active sender or recipient replacement rules that use message-derived replacement data. The exposure depends on the rule configuration and whether a search condition matches. Installations on 15.1.1 or later, or without such rules, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000741,"input_tokens":4155,"output_tokens":652,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114424':17A,20A '-2026':16A,19A '15.1.1':32B,76C 'activ':112C 'attack':35B,80C 'attacker-influenc':34B,79C 'code':41B,86C 'command':14A,57B,102C 'condit':123C 'context':109C,128C 'cve':15A,18A 'data':119C 'deriv':117C 'email':3A,22B,29B,73C 'email-gateway':21B 'evalu':33B,78C 'execut':12A,98C 'gateway':4A,23B,30B,74C 'influenc':36B,81C 'infrastructur':24B 'mail':61B,106C 'mail-process':60B,105C 'match':124C 'messag':116C 'message-deriv':115C 'oper':55B,100C 'operating-system':54B,99C 'os':13A 'perl':11A,25B,40B,85C 'process':62B,107C 'ran':68B 'recipi':45B,90C 'remot':50B,95C 'replac':37B,46B,82C,91C,118C 'root':70B,130C 'rule':47B,92C,113C 'run':9A,53B 'say':67B 'search':122C 'secur':2A,28B,72C 'sender':6A,43B,51B,88C,96C 'sender-suppli':5A 'seppmail':1A,26B,27B,71C 'sourc':66B 'suppli':7A 'system':56B,101C 'text':8A,38B,83C 'unauthent':49B,94C 'use':114C 'valid':126C 'worker':63B,108C,127C","nicknames":[],"mitigations":[],"who_affected":"Organisations running SEPPmail Secure Email Gateway before 15.1.1 with active sender or recipient replacement rules that use message-derived replacement data. The exposure depends on the rule configuration and whether a search condition matches. Installations on 15.1.1 or later, or without such rules, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","emailgateway","infrastructure","perl","seppmail"],"campaign_type":null,"first_public_at":"2026-11-04T09:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114424","severity":null,"published_at":"2026-11-04T09:17:41+00:00","modified_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","fetched_at":"2026-11-04T09:26:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}