Vulnerability intelligence

CVE-2026-44127

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

CVSS Score

8.8

High

EPSS — Exploit Probability

16%

Riskier than 97% of all CVEs · checked 2026-09-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories