Skip to content
OpenAdvisories
High WID-SEC-2026-3178 3 CVEs

SEPPmail Secure E-Mail Gateway: Mehrere Schwachstellen

Published Sep 3, 2026 · Updated Sep 3, 2026 · de-DE

Vendor: SEPPmail Product: Secure E-Mail Gateway Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway ausnutzen, um beliebige Kommandos auszuführen und um Sicherheitsmechanismen zu umgehen.

Product

SEPPmail Secure E-Mail Gateway ist eine Lösung zum Schutz der E-Mail-Kommunikation durch Verschlüsselung und Signierung.

Vulnerabilities 3

  • High 8.6
    CVE-2026-84830

    OS command injection in privileged configuration handling

    SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.

    SEPPmail Secure Email Gateway
  • High 8.6
    CVE-2026-84832

    Unsafe deserialization in the REST interface

    SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges.

    SEPPmail SEPPmail Secure Email Gateway (SEG)
  • High 7.7
    CVE-2026-84831

    Mandatory MFA bypass before enrollment

    SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality wit…

    SEPPmail SEPPmail Secure Email Gateway (SEG)

Revision history

  1. #1

    Initiale Fassung

References