CVE-2026-114426

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data…

Risk score: 57/100
CVSS: 8.7 v4.0
Published: 4 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailabilit…
Affected: See advisory
Fix: Upgrade the product to 15.1.1 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.7 high
Remotely exploitable without logging in

References

https://docs.seppmail.com/en/20_revision-history.html

Original description

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.

Last activity 4 Nov 2026. Patch Forecast updates every hour.