Critical severity · published May 8, 2026
CVE-2026-44126
Insecure deserialization
9.2
CVSS
0.5%
EPSS
No
On KEV
Description
SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticated remote attackers to execute code via a crafted serialized object.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · SEPPmail AG
before 15.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44126
downloads.seppmail.com
https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
labs.infoguard.ch
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
More from Secure Email Gateway
9.3
CVE-2026-44125
Missing Authorization in GINAv2
9.3
CVE-2026-44128
Unauthenticated Remote Code Execution
8.8
CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion
8.6
CVE-2026-84830
OS command injection in privileged configuration handling
8.3
CVE-2026-44129
Server-side template injection