CVE-2026-44128: SEPPmail Secure Email Gateway: unauthenticated RCE via Perl eval injection in GINA UI
CVE-2026-44128 affects SEPPmail Secure Email Gateway versions before 15.0.2.1 and is rated critical by the CNA, with a CVSS 4.0 base score of 9.3. An endpoint in the new GINA UI passes attacker-controlled input to Perl's eval, which the record describes as allowing unauthenticated remote code execution. No confirmed exploitation appears in the sources consulted, and the record contains no structured affected or fixed product entries.
Overview
SEPPmail Secure Email Gateway is an email security appliance. According to the record, CVE-2026-44128 affects versions before 15.0.2.1 and concerns the new GINA UI, where an endpoint passes a parameter value to Perl's eval function without adequate control. The weakness is classified as CWE-95 (Eval Injection). Further technical context is available in the InfoGuard Labs post and the vendor's release notes.
Impact
- The record describes unauthenticated remote code execution.
- The CNA rates the issue critical, with a CVSS 4.0 base score of 9.3 and a vector indicating high impact on confidentiality, integrity and availability of the vulnerable component.
- Successful exploitation could allow an outside party to run code on the gateway, which would put mail traffic and appliance configuration at risk. This consequence is an inference from the description and the CVSS vector, not a confirmed observation.
Affected products and versions
- Product: SEPPmail Secure Email Gateway.
- Affected range stated in the description: versions before 15.0.2.1.
- The record's structured affected list is empty, so exact version boundaries should be confirmed with the vendor before drawing conclusions about specific builds.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability recorded is 0.00735, with a percentile of 0.53214.
Remediation and mitigation
- Inventory all SEPPmail gateways and identify any running a version earlier than 15.0.2.1.
- Apply the vendor update described in the release notes for the security fix. The record does not state the exact fixed build.
- Until patching is complete, limit access to administrative and GINA UI interfaces to trusted networks and reduce unnecessary internet exposure.
- After patching, confirm the running version using vendor-provided information.
Detection guidance
- Review gateway web and application logs for unusual requests to GINA UI paths, especially those with unexpected parameter content.
- Monitor the appliance for unexpected child processes, unexpected file changes and unusual outbound connections.
- Centralize and retain logs so that activity before patching can be reviewed.
Limitations of the available information
The record contains no structured affected or fixed version data and does not name the specific vulnerable endpoint. The CVSS vector uses only base metrics, and the EPSS date in the record should be checked against its source. This analysis does not include exploitation details or proof-of-concept material.
Frequently asked questions
Which SEPPmail versions are described as affected?
The record describes SEPPmail Secure Email Gateway versions before 15.0.2.1 as affected. The structured affected list is empty, so confirm exact ranges with the vendor.
Is this vulnerability being actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Identify gateways running versions before 15.0.2.1, apply the vendor's security update, and restrict access to administrative and GINA UI interfaces until patching is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.