CVE-2026-44128CWE-95

Unauthenticated Remote Code Execution

Critical · published May 8, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00735 · 53.9th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-05-08T13:13Z
EPSS history
Timeline
  • 08 MAY 13:13Z
    Unauthenticated Remote Code Execution
    cvelistv5