SEPPmail Secure Email Gateway Deserialization Flaw Allows RCE

Publication date: 2026-05-08

Last updated on: 2026-05-18

Assigner: Switzerland Government Common Vulnerability Program

Description

SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticated remote attackers to execute code via a crafted serialized object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-18

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-44126

EUVD

EUVD-2026-28635

Affected Vendors & Products

Vendor	Product	Version / Range
seppmail	secure_email_gateway	to 15.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability exists in SEPPmail Secure Email Gateway versions before 15.0.4. It involves insecure deserialization of untrusted data, which can be accessed through the new GINA UI. An unauthenticated remote attacker could exploit this by sending a specially crafted serialized object, potentially allowing them to execute arbitrary code on the affected system.

Impact Analysis

The vulnerability can allow unauthenticated remote attackers to execute arbitrary code on the affected SEPPmail Secure Email Gateway system. This could lead to full system compromise, unauthorized access to sensitive email data, disruption of email services, and potential further attacks within the network.

Hi! I’m here to help you understand CVE-2026-44126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70