Critical severity · published May 8, 2026
CVE-2026-44125
Missing Authorization in GINAv2
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · SEPPmail AG
before 15.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44125
downloads.seppmail.com
https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
labs.infoguard.ch
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
More from Secure Email Gateway
9.3
CVE-2026-44128
Unauthenticated Remote Code Execution
9.2
CVE-2026-44126
Insecure deserialization
8.8
CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion
8.6
CVE-2026-84830
OS command injection in privileged configuration handling
8.3
CVE-2026-44129
Server-side template injection