CVE-2026-44128: Unauthenticated Remote Code Execution
Published May 8, 2026
·Updated
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.
Affected Software
1 affected component
SEPPmail SEPPmail Secure Email Gateway<15.0.2.1
Event History
May 8, 2026
CVE Published
via MITRE·01:13 PM
Data Sourced
via MITRE·01:13 PM
DescriptionWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-44128?
CVE-2026-44128 is classified as a critical vulnerability due to its potential for unauthenticated remote code execution.
2
How do I fix CVE-2026-44128?
To mitigate CVE-2026-44128, update the SEPPmail Secure Email Gateway to version 15.0.2.1 or later.
3
What type of attack does CVE-2026-44128 enable?
CVE-2026-44128 allows for unauthenticated remote code execution which could lead to full system compromise.
4
Which versions of SEPPmail Secure Email Gateway are affected by CVE-2026-44128?
CVE-2026-44128 affects all versions of SEPPmail Secure Email Gateway prior to 15.0.2.1.
5
Can CVE-2026-44128 be exploited remotely?
Yes, CVE-2026-44128 can be exploited remotely, allowing attackers to execute malicious code without authentication.