CVE-2026-114424

Unrated

Published 2026-11-04 · last changed 2026-11-04

The fix

We hold no Microsoft remediation data for CVE-2026-114424, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.

Sources

NVD record for CVE-2026-114424