CVE-2026-44126CWE-502

Insecure deserialization

Critical · published May 8, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticated remote attackers to execute code via a crafted serialized object.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00756 · 54.7th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-05-08T13:15Z
EPSS history
Timeline
  • 08 MAY 13:15Z
    Insecure deserialization
    cvelistv5