CVE Intelligence
Analysis AI-assisted

CVE-2026-27441: SEPPmail Secure Email Gateway PDF Password OS Command Injection

CVE-2026-27441 affects SEPPmail Secure Email Gateway before 15.0.1. The record states that the PDF encryption password is insufficiently neutralized, which allows operating system command execution (CWE-78). NVD rates it critical with a CVSS base score of 9.8, and no exploitation is confirmed in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

SEPPmail Secure Email Gateway releases before 15.0.1 insufficiently neutralize the password used for PDF encryption. According to the record, this allows operating system command execution, classified as OS Command Injection (CWE-78).

Impact

  • NVD assigns a CVSS base score of 9.8 (critical). The vector in the record indicates network attack, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA NCSC.ch lists 9.5 under a newer scoring system, reported by two providers.
  • SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • The record lists Seppmail Secure Email Gateway and a second entry named Seppmail Seppmail, both marked as affected before 15.0.1.
  • The only version referenced in the record is 15.0.1. The record contains no separate list of fixed builds.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The record shows an EPSS probability of 0.00569 and a percentile of 0.46414, and an SSVC exploitation value of none.

Remediation and mitigation

  • Plan an upgrade to version 15.0.1 or a later release, as indicated by the affected range in the record.
  • Review the vendor release notes referenced in the record for official guidance.
  • Until patched, limit who can submit PDF content to the gateway and restrict administrative access to it. This is general defensive practice and not a vendor-confirmed workaround.

Detection guidance

  • Monitor the gateway for unexpected child processes or operating system command activity originating from mail and PDF processing components.
  • Review administrative and processing logs for unusual activity around PDF handling and encryption settings.
  • Centralize logs so that anomalies can be correlated across the mail infrastructure.

Limitations of the available information

  • The record does not describe the exact request format, the affected function, or the conditions required to trigger the issue beyond the CVSS vector.
  • The record does not state whether default configurations are vulnerable.
  • The record contains no fixed-version list, so the exact fixed build must be confirmed with the vendor.
  • The EPSS date in the record is not consistent with the publication date and should be verified before use in prioritization.

Frequently asked questions

What is CVE-2026-27441?

It is a vulnerability in SEPPmail Secure Email Gateway before 15.0.1 where the PDF encryption password is insufficiently neutralized, allowing operating system command execution.

How severe is this issue?

NVD assigns a CVSS base score of 9.8, rated critical. The NCSC.ch CNA lists 9.5 under a newer scoring system.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version should I upgrade to?

The record references version 15.0.1 as the boundary of the affected range. Confirm the exact fixed build with the vendor release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.