PT-2026-136900
CVE-2026-114424
·
Published
2026-11-04
·
Updated
2026-11-05
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
SEPPmail Secure Email Gateway versions prior to 15.1.1
Description
An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context, which operates with root privileges. This occurs when the system evaluates attacker-influenced replacement text as Perl code within sender or recipient replacement rules, provided an active rule uses message-derived replacement data and its search condition is matched.
Recommendations
Update to version 15.1.1.
Found an issue in the description? Have something to add? Feel free to write us 👾