Critical vulnerabilities in the SEPPmail Secure E-Mail Gateway appliance, including pre-authentication remote code execution (RCE) chains and local file inclusion flaws capable of exposing all mail traffic on the device.
The findings, published in May 2026, cover seven CVEs spanning two major components: the Large File Transfer (LFT) module and the new GINA V2 web interface, and affect thousands of publicly accessible SEPPmail instances identified via Censys scans.
The InfoGuard team initiated the research after an ETH Zurich project surfaced an earlier OS command injection flaw (CVE-2026-27441), leading them to conclude that additional unexplored components warranted deeper scrutiny.
Multiple Critical SEPPmail Gateway Flaws
The most severe finding, CVE-2026-2743, resides in the Large File Transfer (LFT) feature, a functionality enabled by the majority of customers according to Censys-based scans.
The /v1/file.app backend processes chunked file uploads using an unsanitized file parameter extracted directly from user-supplied JSON.
This allows directory traversal sequences (../) to escape the session directory and write arbitrary files anywhere the nobody user has write access.
Critically, the nobody user holds write access to /etc/syslog.conf. Since OpenBSD’s syslogd supports piping log messages into shell commands; attackers overwrite this config file with a Perl-based reverse shell payload.
Execution is triggered by forcing a newsyslog rotation achievable by flooding log files via web requests, which sends a SIGHUP to syslogd every 15 minutes via cron. The full exploit chain requires no prior authentication and results in complete appliance takeover.
Affected versions: SEPPmail 15.0.2.1 and earlier. Fixed in: 15.0.4. Defenders can verify exposure by checking if https://<gateway>/v1/file.app returns HTTP 404 (not affected) or a non-404 status (potentially affected).
The GINA V2 web interface, available since early 2025, introduces three additional critical flaws:
- CVE-2026-44128 – The
/api.app/templateendpoint passes a user-supplieduplddparameter directly into a Perleval()statement with no sanitization and no authentication check, enabling unauthenticated RCE via Perl injection - CVE-2026-44127 – The attachment preview endpoint accepts arbitrary file paths via an
identifierparameter, enabling Local File Inclusion (LFI) to read LDAP databases, mail content, password hashes, and cryptographic keys - CVE-2026-7864 – The unauthenticated
/api.app/hello?op=envendpoint dumps the server’s complete environment variables, exposing sensitive configuration data
Successful exploitation of CVE-2026-2743 or CVE-2026-44128 results in complete appliance takeover, with attackers able to read all inbound and outbound mail traffic in cleartext and establish persistent backdoor access.
InfoGuard notes that Blue Teams typically have no visibility into these virtual appliances, making detection especially difficult post-compromise.
The coordinated disclosure spanned February to May 2026, with the first report submitted on February 12 and all CVEs released on May 8, 2026.
Notably, a third vulnerability report submitted in March, which could also trigger RCE, was overlooked by SEPPmail until May 15.
Mitigation
- Immediately update all SEPPmail instances to version 15.0.4 or later
- Disable or restrict the Large File Transfer (LFT) feature if not operationally required
- Do not expose GINA V2 publicly unless patched; the feature requires explicit activation
- Enable audit logging on gateway appliances and monitor for unexpected outbound connections or unusual file system writes
The research underscores a broader concern: as LLM-assisted vulnerability discovery matures, the time and skill required to find and exploit critical flaws in widely deployed infrastructure continue to fall.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 chains and local file inclusion flaws capable of exposing all mail traffic on the device.){kind=link}