CVE-2026-114421
UnratedPublished 2026-11-04 ยท last changed 2026-11-04
The fix
We hold no Microsoft remediation data for CVE-2026-114421, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.
What it is
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.