Medium severity · published May 8, 2026
CVE-2026-7864
Exposure of Sensitive Information to an Unauthorized Actor
6.9
CVSS
16.1%
EPSS
No
On KEV
Description
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.
Exploitation
Is it being used?
Exploit prediction (EPSS)16.1% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Secure Email Gateway · SEPPmail AG
before 15.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7864
downloads.seppmail.com
https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security
labs.infoguard.ch
https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
More from Secure Email Gateway
9.3
CVE-2026-44125
Missing Authorization in GINAv2
9.3
CVE-2026-44128
Unauthenticated Remote Code Execution
9.2
CVE-2026-44126
Insecure deserialization
8.8
CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion
8.6
CVE-2026-84830
OS command injection in privileged configuration handling