SEPPmail released patch 15.1.1 of its Secure Email Gateway on 3 November 2026, and its revision history lists five security fixes for versions before 15.1.1.

The CVE records, published on 4 November 2026 by Switzerland's National Cyber Security Centre (NCSC.ch) as the CVE numbering authority, describe them. CVE-2026-114424 (CVSS 4.0 score 9.2, critical): the gateway can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules, so an unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches; the record says the validated worker context was root.

SEPPmail says the evaluation of replacement values in address replacement rules was hardened to prevent code execution. CVE-2026-114425 (9.2, critical): the gateway trusts a file path supplied in externally provided Large File Transfer (LFT) attachment metadata, so an unauthenticated remote sender can cause the mail-processing worker to disclose, move or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path; SEPPmail says attachment metadata is now validated before any file is accessed.

CVE-2026-114426 (8.7, high): upload data in the v1 file interface was processed before authentication and without an absolute size limit, letting an unauthenticated attacker exhaust workers and temporary storage. CVE-2026-114421 and CVE-2026-114420 concern the GINA web interface: missing LDAP escaping in an unauthenticated account lookup lets an attacker enumerate email addresses, and password recovery for a created but unregistered GINA account with an empty initial password lets an attacker set a new password and take the account over.

The CVE records credit Dario Weiss of InfoGuard Labs for the three first-listed flaws and Synack for the two GINA flaws. Neither SEPPmail nor the CVE records say any of these flaws has been exploited. (sources: SEPPmail; CVE records, NCSC.ch)