SEPPMail Email Gateway Has CVSS 10 Flaw That Lets Attackers Read All Mail

Three critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade encrypted email platform deployed across financial services, healthcare and government-adjacent organisations in Europe, the Middle East and Africa. The flaws, identified and reported by InfoGuard Labs researchers Dario Weiss, Manuel Feifel and Olivier Becker, allow an unauthenticated remote attacker to intercept all mail traffic passing through the appliance and execute arbitrary code on the internal network without requiring any prior credentials or access.

For organisations across the GCC that depend on encrypted email appliances to meet regulatory obligations, the disclosure carries immediate operational significance.

What SEPPMail is and why it matters in the region

SEPPMail is a Swiss-developed secure email gateway used by enterprises that require end-to-end encrypted communication for compliance purposes. It is particularly common in sectors where email privacy is a regulatory requirement rather than a preference, including banking, insurance, legal services, healthcare and government-adjacent operations.

In the GCC context, organisations in the UAE operating under PDPL obligations and enterprises in Saudi Arabia subject to NCA data protection requirements frequently rely on appliances of exactly this type to protect sensitive commercial and regulatory correspondence. Any compromise of the gateway does not merely expose individual emails. It exposes the entire encrypted communication stream passing through it, potentially over an extended period before detection.

The seven vulnerabilities disclosed

InfoGuard Labs identified seven distinct flaws across the SEPPMail platform. Four of them are exploitable by unauthenticated remote attackers, meaning no login, no credentials and no prior foothold in the network is required to begin an attack.

The most severe is CVE-2026-2743, carrying a CVSS score of 10.0 and a critical classification. It is a path traversal vulnerability in the large file transfer feature of the SEPPMail User Web Interface. An attacker who exploits it can write arbitrary files to the appliance filesystem, a capability that translates directly to remote code execution. Researchers demonstrated a concrete attack path: by overwriting the system syslog configuration file using write access available to the "nobody" user account, an attacker can force a configuration reload through log rotation, which runs automatically every 15 minutes via cron, and obtain a Perl-based reverse shell on the appliance. The end result is a complete takeover of the SEPPMail gateway, with the ability to read all mail traffic and persist indefinitely on the device.

CVE-2026-44128 scores 9.3 and represents a separate remote code execution path. It is an eval injection vulnerability in the template feature of the appliance's API. The endpoint passes user-supplied input directly into a Perl eval() statement without any sanitisation, allowing an unauthenticated attacker to execute arbitrary code by submitting a crafted request. No exploit chain or privilege escalation is required.

CVE-2026-44126 scores 9.2 and exploits deserialization of untrusted data. An unauthenticated remote attacker can submit a crafted serialised object to execute code on the appliance. This is a well-understood vulnerability class that has been responsible for widespread enterprise compromises across multiple platforms over recent years, and its presence here in an unauthenticated context makes it particularly serious.

CVE-2026-44125 also scores 9.3 and enables unauthenticated access to functionality that would otherwise require a valid session. Researchers confirmed this vulnerability enables an attacker to read all mail traffic traversing the appliance, positioning the gateway simultaneously as a surveillance tool and as a network entry point for deeper lateral movement.

CVE-2026-44127 scores 8.8 and is a path traversal vulnerability in the attachment preview endpoint. It allows unauthenticated remote attackers to read arbitrary local files on the appliance and trigger deletion of files in targeted directories, operating with the privileges of the api.app process.

CVE-2026-44129 scores 8.3 and involves improper neutralisation of special elements in a template engine. Remote attackers can execute arbitrary template expressions through it, with the potential to achieve remote code execution depending on which template plugins are enabled on the specific deployment.

CVE-2026-7864 is the least severe at 6.9, but it is not trivial. It exposes sensitive server environment variables through an unauthenticated endpoint in the GINA interface component. In practice, this means an attacker can extract internal credentials, API keys and configuration data without authentication, information that directly supports lateral movement and further exploitation across the broader network.

The attack scenario researchers demonstrated

InfoGuard Labs documented a realistic exploitation chain centred on CVE-2026-2743. The attack exploits the path traversal to overwrite the syslog configuration file at /etc/syslog.conf. Because syslogd only re-reads its configuration upon receiving a SIGHUP signal, the attacker then needs to trigger a log rotation. SEPPMail uses newsyslog for log rotation, which runs every 15 minutes via cron and automatically sends SIGHUP to syslogd after rotating files that exceed a defined size limit. By bloating the SEPPMaillog file, which has a 10,000 KB limit, through repeated web requests, the attacker forces a rotation and a subsequent configuration reload, completing the chain and delivering a reverse shell.

This attack requires no authentication, no special tools and no insider knowledge beyond the disclosed vulnerability details. The 15-minute maximum wait time for the cron rotation is the only meaningful friction in the chain.

Why GCC enterprises are directly exposed

The exposure is not theoretical. Enterprises across the Gulf that use SEPPMail or comparable encrypted email appliances for regulatory compliance face a specific set of risks from these vulnerabilities that go beyond typical software flaws.

An attacker with access to a compromised SEPPMail appliance can conduct long-term passive surveillance of commercial contracts and regulatory correspondence, intercept one-time passwords and approval workflows delivered over email, access encrypted communications that were assumed to be protected under compliance frameworks, and use the appliance as a persistent foothold into the broader corporate network. The passive surveillance capability of CVE-2026-44125 in particular means that a compromise may have occurred prior to patch application without leaving obvious indicators. Mail that was assumed to be secure during that window should be treated as potentially exposed.

The GCC cybersecurity compliance landscape is increasingly demanding on exactly these categories of control. Regulators across the UAE, Saudi Arabia and Bahrain have elevated expectations around the integrity of encrypted communications infrastructure. A compromised email gateway in a regulated entity is not simply a technical incident. It is a potential reportable breach under applicable frameworks.

Patch status and immediate actions

SEPPMail has released patches across three successive versions. CVE-2026-44128 was addressed in version 15.0.2.1. CVE-2026-44126 was fixed in version 15.0.3. All remaining vulnerabilities, including the CVSS 10.0 CVE-2026-2743, have been patched in version 15.0.4.

Organisations running SEPPMail should treat upgrade to version 15.0.4 as an immediate priority. Where patching cannot be completed without a maintenance window, the following interim measures materially reduce the exploitable attack surface: restricting access to the GINA UI and the large file transfer endpoint at the network perimeter, ensuring the appliance is not directly exposed to the public internet without network-level access controls, and blocking unauthenticated access to the affected API endpoints at the application layer where possible.

Security teams should audit appliance logs for anomalous unauthenticated requests made to the /api.app/attachment/preview, /api.app/template and GINA UI endpoints prior to patch application. Given the passive surveillance capability, the possibility of historic mail interception should be assessed as part of any incident response process. Organisations with incident response obligations under UAE or Saudi NCA frameworks should consider whether notification requirements are triggered if evidence of prior exploitation is identified during the log review.

This disclosure follows SEPPMail's patch release just weeks earlier for CVE-2026-27441, a separate critical vulnerability scoring 9.5 that allowed arbitrary operating system command execution. Two critical disclosure cycles within weeks of each other on the same platform warrants a broader architectural review of how the appliance is deployed, segmented and monitored within affected environments.

For enterprise security teams across the MENA region, the practical lesson is consistent with the broader pattern of gateway and appliance vulnerabilities that have defined the threat landscape in 2026: perimeter appliances that handle sensitive data are high-value targets, and their patch cycles demand the same urgency applied to endpoint and cloud workload security.