CVE-2026-84830 OS command injection in privileged configuration handling
8.6
Analysis on rafaelpfister.ch
- Article · October 26, 2026 SEPPmail 15.0.7, 15.1.0, and 15.1.0.1: CVE Fixes and New Feature Branch SEPPmail 15.0.7 fixes a command injection vulnerability (CVE-2026-84830) and an MFA bypass (CVE-2026-84831) and is the final release in the 15.0 branch. 15.1.0 and hotfix 15.1.0.1 add new administration and monitoring functions as well as two further security fixes, including one with a CVSS score of 9.9.
- Article · July 29, 2026 Connect the SEPPmail Admin GUI to Active Directory: Set Up LDAP Authentication from 15.0.6 Since firmware version 15.0.6, administrators of the SEPPmail appliance can authenticate against an external LDAP server such as Active Directory, including group mapping to the local admin group. Setup under User > Advanced Settings, step by step.
Vendor description
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges. Reference data
- Vendor
- SEPPmail AG
- Affected products
- Secure Email Gateway
- CVSS 4.0
- 8.6 (HIGH)
- Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness type
- CWE-78: OS Command Injection
- Published
- September 3, 2026
