CVE-2026-114424: Code execution through double evaluation in address replacement rules
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
SEPPmail Secure Email Gateway deployments before 15.1.1 are exposed if they have an active sender or recipient replacement rule that uses message-derived replacement data and whose search condition can be matched by an incoming message.
What does an attacker need to exploit this issue?
An attacker only needs to send a crafted message remotely and does not need authentication or user interaction. Exploitation depends on matching an active vulnerable address-replacement rule.
What is the impact if exploitation succeeds?
The attacker can execute operating-system commands in the mail-processing worker context. The validated worker context was root, so successful exploitation may result in root-level command execution.
What can be done before upgrading?
Review active sender and recipient replacement rules and disable rules that use message-derived replacement data, particularly where their search conditions can be matched by untrusted incoming messages.