SEPPmail 15.1.1: five CVE fixes and a fix for the DNS regression from 15.1.0.1

SEPPmail released patch release 15.1.1 on 27 October 2026. It closes five vulnerabilities with CVSS scores between 6.9 and 9.2, including possible code execution via address replacement rules and the reading or deletion of arbitrary files via manipulated Large File Transfer attachments. It also includes hardening of PGP processing, a fix for DNS resolution that became faulty with 15.1.0.1, and changes to MPKI, S/MIME, backup and virtualisation. The release is aimed at all operators of SEPPmail appliances, including appliances running as a HIN Mailgateway, as these are based on SEPPmail firmware. The previous status is described in the article on SEPPmail 15.0.7, 15.1.0 and 15.1.0.1.

The versions at a glance

Security fixes in 15.1.1

The revision history lists five entries with CVE IDs. In each case, it identifies versions prior to 15.1.1 as affected; it does not specify a CVSS version.

• CVE-2026-114424, CVSS 9.2: Replacement values in address replacement rules were processed incorrectly. If a rule set used values from the message as replacement values, a remote sender could execute commands on the appliance. The evaluation has been hardened.
• CVE-2026-114425, CVSS 9.2: Specially crafted attachment metadata in incoming messages could cause Large File Transfer processing (LFT) to read or delete arbitrary files. Metadata is now validated before every file access.
• CVE-2026-114426, CVSS 8.7: The upload interface processed request data before authentication had been checked. Unauthenticated attackers could thus exhaust disk space and worker processes. Authentication now takes place first, and the upload size is additionally limited.
• CVE-2026-114420, CVSS 8.3, and CVE-2026-114421, CVSS 6.9: Insufficient escaping in account searches and a missing check in the password recovery process enabled the takeover of GINA accounts. LDAP filter values are now escaped, and recovery now queries only registered users with configured security questions. The revision history describes both CVEs with identical text and an identical fix, but gives different CVSS scores.

Two further items concern PGP but have no CVE ID: keys with user IDs that are not self-signed are no longer accepted, and PGP messages without actual encryption (NULL encryption) are detected and no longer marked as encrypted.

As of 3 November 2026, the five CVE entries have not been published on either CVE.org or the NVD. Vectors, CWE classification and an assessment of exploitability are therefore not yet available; the CVSS scores originate from the revision history. According to the manufacturer’s description, two of the vulnerabilities (CVE-2026-114424 and CVE-2026-114425) can be triggered through incoming messages, and CVE-2026-114426 without authentication. Until the update, check which address replacement rules accept values from messages and whether LFT and GINA password recovery are active.

For the two security fixes from 15.1.0 (root CA management via REST API with CVSS 9.9 and stored XSS in the log viewer with CVSS 7.1), the revision history still states “CVE ID: Pending” (as of 3 November 2026).

New features and changes

• Virtualisation: The appliance supports the QEMU Guest Agent (qemu-ga).
• Admin: A new system option disables collection of Customer Summary data, which according to the manufacturer can take a long time on large installations.
• Backup in the cluster: All cluster members create a database backup, but it is sent only by the maintenance node. A missing backup operator no longer appears as an error in the daily report, as large databases are generally backed up via SCP.
• Core dumps: The default size is limited so that core dumps do not fill the /tmp partition.
• RuleEngine: If key material is missing during signing or encryption, the appliance generates it automatically (with a local user if necessary), provided that the relevant options are enabled. Otherwise, the message is no longer rejected.
• S/MIME: If automatic deletion and the daily revocation check are enabled, revoked certificates are also deleted automatically.
• MPKI: The D-Trust connector complies with Connector Specification 2.28, the GlobalSign root CA chain has been updated, and SwissSignREST orders that are not issued in time remain pending and are completed later to prevent duplicates.
• Disclaimer: The Content-ID headers of inline images and attachments comply with RFC 2045.
• Outlook Add-In: Support for HIN ACS in the COM Outlook Add-In has been removed because HIN provides its own software according to the release notes.

Operators of a HIN Mailgateway whose users use HIN ACS through the COM Outlook Add-In should clarify before updating which HIN software will take over this function. If automatic certificate deletion is enabled together with the daily revocation check, the appliance will also remove revoked S/MIME certificates after the update.

Bug fixes

• Operating system: Since 15.1.0.1, external DNS names could no longer be resolved after setting up a local DNS zone with the integrated resolver.
• Admin: The HTML preview for disclaimers had not worked since 15.0.6.1. Disclaimer and template files are now written in UTF-8, so special characters are no longer corrupted. The Managed Domain settings page loads correctly after creating a Managed Domain.
• Logging: The database logging page also loads when entries contain empty data, rotated mail logs can be viewed again, and rebuilding the mail log archive index runs without errors.
• REST API: PUT /v1/ssl returns the actual error message instead of an internal server error, and PUT /webmail/domain/{domainName} works with the “Initial password via SMS” option enabled.
• S/MIME: The result of the CRL check now overrides the OCSP result, so revoked certificates are marked as revoked.
• RuleEngine: make_lft() works when an LFT has multiple recipients and only some of them are authorised.
• Webmail (GINA): Read receipts for messages sent to multiple recipients are sent to all recipients instead of only the first.
• MPKI: The SwissSignREST connector settings are loaded in the admin GUI.

Known issues

• DNS resolution with a local DNS zone (15.1.0.1): fixed in 15.1.1.
• HTML preview for disclaimers (since 15.0.6.1): fixed in 15.1.1.
• CVE IDs for the security fixes from 15.1.0: still pending (“Pending”, as of 3 November 2026).

The release notes for 15.1.1 do not contain a Known Issues section.

Recommended procedure

The target version is 15.1.1, as all five new CVEs affect versions prior to 15.1.1 and two of them can be exploited through incoming messages. According to the revision history, 15.0.7 enables the update to 15.1; systems on the 15.0 branch should therefore first be updated to 15.0.7 and then to 15.1.1. Create a backup before the update and, for virtual appliances, an additional snapshot, as recommended by the manufacturer documentation. The release notes do not provide information on the update order in the cluster or a minimum version for 15.1.1 (as of 3 November 2026).