CVE-2026-44129: Server-side template injection

Severity: high (CVSS 8.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-10-26
Weakness: CWE-1336

Description

SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.

Affected products

SEPPmail AG Secure Email Gateway: before 15.0.4 — fixed in 15.0.4

How to fix

Upgrade to a fixed version: SEPPmail AG Secure Email Gateway 15.0.4. Check the vendor advisory for mitigations.

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/

Get alerted when CVE-2026-44129 or the next vulnerability affects your stack