Perl Code Injection Vulnerability in SEPPmail Secure Email Gateway

CVE-2026-114424

What is CVE-2026-114424?

The SEPPmail Secure Email Gateway, prior to version 15.1.1, is susceptible to a code injection vulnerability that allows an unauthenticated remote sender to execute arbitrary operating system commands. This exploitation is possible through attacker-controlled replacement text evaluated as Perl code within sender or recipient replacement rules. If the active rule applies message-derived replacement data that meets the search criteria, the command execution takes place in a context where validation is performed by a root-level worker, significantly increasing the risk of system compromise.

References