SEPPmail 15.1.1: Five CVE Fixes and a Fix for the DNS Regression from 15.1.0.1

SEPPmail released patch release 15.1.1 on October 27, 2026. It closes five vulnerabilities with CVSS scores between 6.9 and 9.2, including possible code execution through address replacement rules and the reading or deletion of arbitrary files through manipulated Large File Transfer attachments. It also includes hardening for PGP processing, a fix for DNS resolution that became faulty in 15.1.0.1, and changes to MPKI, S/MIME, backup, and virtualization. The release is intended for all operators of SEPPmail appliances, including appliances running as HIN Mailgateway, as these are based on SEPPmail firmware. The previous status is described in the article on SEPPmail 15.0.7, 15.1.0, and 15.1.0.1.

Versions at a glance

Security fixes in 15.1.1

The Revision History lists five entries with CVE IDs. Each identifies versions before 15.1.1 as affected; it does not specify a CVSS version.

• CVE-2026-114424, CVSS 9.2: Replacement values in address replacement rules were processed incorrectly. If a rule set used values from the message as replacement values, a remote sender could execute commands on the appliance. The evaluation has been hardened.
• CVE-2026-114425, CVSS 9.2: Specially crafted attachment metadata in incoming messages could cause Large File Transfer processing (LFT) to read or delete arbitrary files. Metadata is now validated before every file access.
• CVE-2026-114426, CVSS 8.7: The upload interface processed request data before authentication had been verified. Unauthenticated attackers could thus exhaust disk space and worker processes. Authentication now occurs first, and the upload size is additionally limited.
• CVE-2026-114420, CVSS 8.3, and CVE-2026-114421, CVSS 6.9: Insufficient escaping in account searches and a missing check in the password recovery flow allowed GINA accounts to be taken over. LDAP filter values are now escaped, and recovery now queries only registered users with configured security questions. The Revision History describes both CVEs with identical text and the same fix, but lists different CVSS scores.

Two additional items concern PGP but have no CVE ID: keys with User IDs that are not self-signed are no longer accepted, and PGP messages without actual encryption (NULL encryption) are detected and no longer marked as encrypted.

As of November 3, 2026, the five CVE entries have not been published by either CVE.org or the NVD. Vectors, CWE classification, and an assessment of exploitability are therefore not yet available; the CVSS scores come from the Revision History. According to the vendor description, two of the vulnerabilities (CVE-2026-114424 and CVE-2026-114425) can be triggered through incoming messages, while CVE-2026-114426 can be triggered without authentication. Until updating, check which address replacement rules accept values from messages and whether LFT and GINA password recovery are active.

For the two security fixes from 15.1.0 (Root CA management through the REST API with CVSS 9.9 and stored XSS in the log viewer with CVSS 7.1), the Revision History still states “CVE ID: Pending” (as of November 3, 2026).

New features and changes

• Virtualization: The appliance supports the QEMU Guest Agent (qemu-ga).
• Admin: A new system option disables collection of Customer Summary data, which the vendor says can take a long time on large installations.
• Backup in the cluster: All cluster members create a database backup, but it is sent only from the Maintenance Node. A missing backup operator no longer appears as an error in the Daily Report because large databases are usually backed up via SCP.
• Core dumps: The default size is limited so that core dumps do not fill the /tmp partition.
• RuleEngine: If key material is missing during signing or encryption, the appliance generates it automatically (with a local user if necessary), provided the relevant options are enabled. Otherwise, the message is no longer rejected.
• S/MIME: If automatic deletion and the daily revocation check are enabled, revoked certificates are also deleted automatically.
• MPKI: The D-Trust connector complies with Connector Specification 2.28, the GlobalSign Root CA chain has been updated, and SwissSignREST orders that are not issued in time remain pending and are completed later to prevent duplicates.
• Disclaimer: The Content-ID headers of inline images and attachments comply with RFC 2045.
• Outlook Add-In: Support for HIN ACS in the COM Outlook Add-In has been removed because, according to the release notes, HIN provides its own software.

Operators of a HIN Mailgateway whose users use HIN ACS through the COM Outlook Add-In should clarify before updating which HIN software will take over this function. If automatic certificate deletion is enabled together with the daily revocation check, the appliance will also remove revoked S/MIME certificates after the update.

Bug fixes

• Operating system: Since 15.1.0.1, external DNS names could no longer be resolved after setting up a local DNS zone with the integrated resolver.
• Admin: The HTML preview for disclaimers had not worked since 15.0.6.1. Disclaimer and template files are now written in UTF-8, so special characters are no longer corrupted. The Managed Domain settings page loads correctly after creating a Managed Domain.
• Logging: The database logging page loads even for entries with empty data, rotated mail logs can be viewed again, and rebuilding the mail log archive index runs without errors.
• REST API: PUT /v1/ssl returns the actual error message instead of an internal server error, and PUT /webmail/domain/{domainName} works with the “Initial password via SMS” option enabled.
• S/MIME: The result of the CRL check now overrides the OCSP result, so revoked certificates are marked as revoked.
• RuleEngine: make_lft() works when an LFT has multiple recipients and only some of them are authorized.
• Webmail (GINA): Read receipts for messages sent to multiple recipients are sent to all recipients rather than only the first one.
• MPKI: The settings of the SwissSignREST connector are loaded in the Admin GUI.

Known issues

• DNS resolution with a local DNS zone (15.1.0.1): Fixed in 15.1.1.
• HTML preview for disclaimers (since 15.0.6.1): Fixed in 15.1.1.
• CVE IDs for the security fixes from 15.1.0: Still open (“Pending,” as of November 3, 2026).

The release notes for 15.1.1 do not include a Known Issues section.

Recommended approach

The target version is 15.1.1, as all five new CVEs affect versions before 15.1.1 and two of them are exploitable through incoming messages. According to the Revision History, 15.0.7 enables the update to 15.1; systems on the 15.0 branch should therefore first be updated to 15.0.7 and then to 15.1.1. Create a backup before updating and, for virtual appliances, also create a snapshot, as recommended by the vendor documentation. The release notes do not contain information on the update order in a cluster or a minimum version for 15.1.1 (as of November 3, 2026).