SEPPmail 15.0.7, 15.1.0, and 15.1.0.1: CVE Fixes and New Feature Branch

On September 2, 2026, SEPPmail released patch version 15.0.7; on September 28, 2026, feature release 15.1.0; and on September 29, 2026, hotfix 15.1.0.1. The patch release fixes several vulnerabilities with CVSS scores between 7.7 and 8.6, updates OpenSSL, and, according to the vendor, is the final release in the 15.0 branch while also enabling the update to 15.1. Version 15.1.0 adds new functions for administration, monitoring, the REST API, and webmail, as well as two further security fixes, one of them with a CVSS score of 9.9. The releases are intended for all operators of SEPPmail appliances, including appliances running as HIN Mailgateways, since these are based on SEPPmail firmware. The previous status is described in the article on SEPPmail 15.0.6 and 15.0.6.1.

Versions at a Glance

Security Fixes in 15.0.7

The revision history lists three security entries for 15.0.7. Two of them have been published as CVEs since September 3, 2026; the CNA is the NCSC, and they were discovered by Oualid Lkhaouni (Emposo GmbH).

• CVE-2026-84830, CVSS 8.6 (v4.0): Command injection (CWE-78) in privileged configuration processing. Authenticated administrators could execute commands with elevated privileges. All versions before 15.0.7 are affected.
• CVE-2026-84831, CVSS 7.7 (v4.0): Bypass of mandatory MFA before enrollment (CWE-287, CWE-306). The appliance created a fully privileged session before the required MFA enrollment was complete. Anyone who knew the password of an account subject to MFA but not yet enrolled could use protected functions without a second factor. Versions before 15.0.7 are affected.
• CVE-2026-84832, CVSS 8.6 (v4.0): Insecure deserialization in a privileged REST import workflow (CWE-502). An attacker with a privileged API token could execute arbitrary commands with the permissions of the “nobody” user. The entry appears in the 15.0.7 section, but the release notes and CVE entry identify versions before 15.0.6 as affected. According to this information, systems on 15.0.6 or 15.0.6.1 are already protected.

The CISA ADP assessment in the CVE entries states “Exploitation: none” for all three vulnerabilities (as of October 8, 2026). All three require authentication: an admin account, a known password for an account not yet enrolled in MFA, or a privileged API token. In addition to updating, therefore review which accounts require MFA but have not yet been enrolled, and which API tokens have been issued with which permissions.

Further Changes in 15.0.7

OpenSSL was updated to 3.0.22. The release notes list CVE-2026-63072, CVE-2026-63076, CVE-2026-54874, CVE-2026-63074, and CVE-2026-75803, as well as a corrected verification of authentication tags for empty ciphertexts in CCM mode.

The bug fixes affect several areas:

• Admin: Local users could not be deleted after a certificate revocation, and time zone settings were not saved correctly, including in Cfgserver.
• Clustering: connector.pl did not terminate initial injection connections. Unnecessary SSH warnings no longer appear when displaying cluster status.
• Background tasks: Processes that are still running are handled in a way that prevents processes from overlapping.
• RuleEngine: Temporary directory management was fixed, LFT messages sometimes lacked encrypted attachments, and skipped revocation checks are logged more effectively.
• Webmail (GINA): Cached data was validated against an incorrect value, and session handling was fixed.

The time zone fix follows 15.0.6, which had switched the appliance to valid time zones (default: Europe/Zurich).

Security Fixes in 15.1.0

Version 15.1.0 includes two security fixes, both stemming from an audit by Emposo according to the release notes. As of October 26, 2026, a CVE ID was still pending for both in the revision history (“Pending”).

• Root CA management via REST API, CVSS 9.9: Insufficient authorization checking in the crypto management API. An API token without MSP permissions could add, modify, or delete RootCA certificates. Access to the /crypto/rootca endpoint is now restricted to MSP tokens. The revision history lists versions below 15.0.6.1 as affected but includes the fix under 15.1.0. It cannot be clearly determined from the Sources whether 15.0.6.1 and 15.0.7 are already protected (as of October 26, 2026).
• Stored XSS in the log viewer, CVSS 7.1: A manipulated message ID could be used to inject JavaScript into the admin GUI. External data is now escaped. Versions below 15.1.0 are affected.

In addition, all qx(...) calls were replaced with run_shell_safe, so that arguments are escaped during shell invocation; the vendor lists this as maintenance work. Since the Root CA vulnerability is exploited through an API token, you should review the issued REST API tokens and their permissions until 15.1.0.1 is installed.

New Functions in 15.1.0

• Administration: Growth of the LDAP database is monitored. Delegated administrators can now see only accounts in their tenant. A connection test is available for external key servers.
• Notifications: The appliance reports failed email backups, notifies communication partners of expiring certificates, and warns when LFM storage reaches its capacity limit.
• REST API: Requests to the REST API can be audited.
• RuleEngine: Messages receive metadata on the actions performed, and custom commands can connect to PostgreSQL.
• Webmail (GINA): The file types that external partners may upload through GINA can be restricted.

LDAP synchronization for medium and large installations, certificate revocation checking, and the display of generated email notifications were also changed. OpenSSL is now at 3.5.8 and OpenSSH (sshd) at 10.4. An incomplete API definition for certificate information was corrected.

It is worth configuring the GINA upload restriction and REST API auditing after the update, especially if external partners submit files through GINA or several systems access the appliance through the API.

Hotfix 15.1.0.1

The hotfix from September 29, 2026, fixes an internal server error on the page for editing a GINA domain. The release notes list no further items.

Recommended Approach

The target version is 15.1.0.1. According to the revision history, 15.0.7 is the release that enables the update to 15.1; systems running 15.0.6.1 or earlier should therefore first be updated to 15.0.7 and then to 15.1.0.1. If you plan to remain in the 15.0 branch for now, install at least 15.0.7, as it fixes CVE-2026-84830 and CVE-2026-84831; the Root CA fix and XSS fix from 15.1.0 are listed in the release notes only for 15.1. Before every update, create a backup and, for virtual appliances, an additional snapshot, as recommended in the vendor documentation. The release notes for these versions do not contain information on known issues, end of support for the 15.0 branch, or the update sequence in a cluster (as of October 26, 2026).