CVE-2026-114426 · Infrastructure
NO FIX YET · SEE WHAT TO DO
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before checking the caller's identity, and it has no absolute request-size limit. An unauthenticated remote attacker can tie up workers and fill temporary storage with concurrent or slow requests, making the service unavailable.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organisations running SEPPmail Secure Email Gateway releases before 15.1.1 with the v1 file-interface upload path reachable by remote callers. The sources do not say whether the flaw depends on specific configuration beyond the affected version.
Not affected if version-15.1.1-or-later
Who cares email-gateway, self-hosted, seppmail
15.1.115.1.1 or laterSEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
This page as .md · .json · in your agent: get_signal("CVE-2026-114426") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.