PatchSiren cyber security CVE debrief
CVE-2026-44125 SEPPmail AG CVE debrief
SEPPmail Secure Email Gateway versions prior to 15.0.4 contain a critical authorization bypass vulnerability in the new GINA UI. Multiple endpoints fail to enforce authentication requirements, allowing unauthenticated remote attackers to access administrative functionality that should require a valid session. The vulnerability was disclosed on 2026-05-08 and last modified on 2026-05-18. The vendor has released version 15.0.4 to address this issue. Organizations using affected versions should prioritize upgrading to 15.0.4 or later.
- Vendor
- SEPPmail AG
- Product
- Secure Email Gateway
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-08
- Original CVE updated
- 2026-05-18
- Advisory published
- 2026-05-08
- Advisory updated
- 2026-05-18
Who should care
Organizations operating SEPPmail Secure Email Gateway versions prior to 15.0.4, particularly those with externally accessible administrative interfaces. Security teams responsible for email gateway infrastructure and identity/access management controls should prioritize this patch.
Technical summary
The vulnerability exists in the new GINA UI component of SEPPmail Secure Email Gateway. Multiple endpoints within this interface do not properly validate session authentication state before processing requests. This missing authorization check (CWE-862) permits unauthenticated remote attackers to invoke functionality that should be restricted to authenticated administrative sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects network exploitability with no required privileges or user interaction, and high impacts across confidentiality, integrity, and availability dimensions.
Defensive priority
critical
Recommended defensive actions
- Upgrade SEPPmail Secure Email Gateway to version 15.0.4 or later
- Review access logs for unauthorized access to GINA UI endpoints prior to patching
- Implement network segmentation to restrict access to SEPPmail administrative interfaces
- Monitor for anomalous activity on SEPPmail systems until patching is complete
Evidence notes
Vulnerability description and affected product version derived from official CVE record and vendor release notes. CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability. CWE-862 (Missing Authorization) identified as the weakness type.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-44125 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-44125
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-44125 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44125
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html
-
Source reference
Unverified legacy reference
URL: https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.