CVE-2026-44128: Unauthenticated Remote Code Execution

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-10-26
Weakness: CWE-95

Description

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.

Affected products

SEPPmail AG Secure Email Gateway: before 15.0.2.1 — fixed in 15.0.2.1

How to fix

Upgrade to a fixed version: SEPPmail AG Secure Email Gateway 15.0.2.1. Check the vendor advisory for mitigations.

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/

Get alerted when CVE-2026-44128 or the next vulnerability affects your stack