SEPPmail Gateway Flaws Expose Organizations to RCE and Email Traffic Interception

Multiple critical vulnerabilities in the SEPPmail Secure E-Mail Gateway are putting thousands of organizations at risk of remote code execution (RCE) and the interception of sensitive email.

The flaws, tracked under several CVEs, impact widely deployed SEPPmail appliances used for encrypted email communication, particularly across the DACH region (Germany, Austria, Switzerland).

Security researchers warn that attackers can exploit these issues to gain full control of email gateways, access confidential communications, and maintain persistent access within enterprise environments.

SEPPmail Gateway Flaws

Researchers uncovered multiple high-impact vulnerabilities across different components of the SEPPmail platform:

• CVE-2026-2743: Pre-authenticated remote code execution via arbitrary file write in the Large File Transfer (LFT) module
• CVE-2026-7864: Sensitive information exposure through unauthenticated debug endpoint
• CVE-2026-44127: Local file inclusion (LFI) allowing attackers to read arbitrary files, including emails and credentials
• CVE-2026-44128: Unauthenticated RCE via Perl code injection in GINA v2 interface

Additional flaws included insecure deserialization, missing authorization checks, and server-side template injection.

RCE Chain via File Upload Exploit

The most critical issue, CVE-2026-2743, affects the LFT feature used for handling large email attachments. The vulnerability stems from improper input validation of a file upload parameter, allowing attackers to perform path traversal, according to new research published by InfoGuard Labs.

By manipulating file paths (e.g., using “../”), attackers can write arbitrary files to sensitive locations on the system. Researchers demonstrated that this flaw can be chained into full RCE by overwriting the /etc/syslog.conf file.

For example, an attacker could inject a malicious configuration that forces the system logging service to execute arbitrary commands. Once the system reloads its logging configuration, triggered automatically during log rotation, the payload executes, granting a reverse shell.

This attack requires no authentication and can be triggered remotely if the vulnerable endpoint is exposed.

GINA Interface Enables Web Shell Access

The GINA v2 web interface, designed for secure email access by external recipients, introduces additional attack vectors.

One critical flaw (CVE-2026-44128) allows attackers to inject Perl code into an API endpoint, which is then directly executed via the eval() function. Because authentication checks are missing, attackers can send crafted requests to execute commands on the server.

In a simple proof-of-concept, researchers created files on the target system remotely, effectively demonstrating full command execution capabilities.

Another vulnerability (CVE-2026-44127) enables attackers to read arbitrary files, including stored emails, LDAP databases, and cryptographic material, raising concerns about large-scale data exposure.

Successful exploitation can result in:

• Full compromise of the email gateway
• Interception and decryption of sensitive email traffic
• Access to user credentials and internal directories
• Persistent backdoor access within enterprise networks

Notably, security teams may have limited visibility into these appliances, making detection and response significantly more difficult.

Mitigation and Recommendations

Organizations using SEPPmail are strongly advised to:

• Upgrade to patched versions (15.0.2.1, 15.0.3, 15.0.4 or later)
• Disable unused features such as LFT and GINA v2 if not required
• Restrict external access to management and API endpoints
• Monitor logs for unusual file writes or API activity
• Conduct forensic reviews for potential compromise

Additionally, administrators can check exposure by verifying whether the /v1/file.app endpoint is accessible. A non-404 response may indicate vulnerability.

Researchers noted that some vulnerabilities were identified using AI-assisted analysis, highlighting how modern tools are accelerating vulnerability discovery and exploitation.

This trend lowers the barrier for attackers and reinforces the need for continuous security testing, code audits, and proactive patch management.

The findings underscore a broader issue: even widely deployed security appliances can harbor critical flaws for extended periods, making them attractive targets for threat actors.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.