Loading story…
Researchers disclosed multiple critical vulnerabilities in the SEPPMail Secure E-Mail Gateway that can let attackers achieve remote code execution, read arbitrary files and emails, and maintain persistent control of the appliance. InfoGuard Labs said the exposed web UI and newer GINA v2 interface are affected, with the most severe issues including CVE-2026-2743, an authenticated path traversal in the Large File Transfer component that can be chained into arbitrary file write and code execution, CVE-2026-44128, an unauthenticated Perl injection leading to RCE, CVE-2026-44127, a local file inclusion and arbitrary file deletion flaw, and CVE-2026-7864, an information disclosure bug exposing environment variables through a debug endpoint.
The researchers described a practical takeover path in which an attacker overwrites /etc/syslog.conf and triggers a syslog reload via log rotation to obtain a Perl-based reverse shell, giving full control of the gateway and access to all mail traffic. They warned that the product is widely deployed, particularly in the DACH region, with thousands of internet-exposed instances visible, making the flaws a potential entry point into internal networks. SEPPMail released fixes across versions 15.0.2.1, 15.0.3, and 15.0.4, while public reporting highlighted that successful exploitation could expose sensitive email content and enable long-term compromise of affected organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The Hacker News reported on the SEPPMail disclosures, emphasizing that the vulnerabilities could allow attackers to execute code, read arbitrary files and emails, and gain persistent control of exposed appliances.
InfoGuard Labs published technical details for several SEPPMail Secure E-Mail Gateway flaws, including CVE-2026-2743, CVE-2026-44127, CVE-2026-44128, and CVE-2026-7864, and explained how they could be chained to achieve persistent remote code execution and mail traffic access.
A second Full Disclosure post publicly disclosed CVE-2025-70562 and CVE-2025-70563, describing impersonation attacks on EduPage caused by malicious SVG upload handling combined with missing CSRF protections.
A Full Disclosure mailing list post publicly disclosed CVE-2025-70561, an authorization bypass in EduPage's Payment module that exposed user identities and IBAN banking details to authenticated users and anonymous guest accounts.
SeppMail issued patches for the disclosed gateway vulnerabilities in several releases, fixing CVE-2026-44128 in 15.0.2.1, CVE-2026-44126 in 15.0.3, and the remaining reported flaws in version 15.0.4.
InfoGuard Labs reported multiple vulnerabilities in the SEPPMail Secure E-Mail Gateway to SeppMail over a period spanning February to May 2026, including issues that could lead to file access, arbitrary file write, and remote code execution.
Juraj Kosik published a detailed public report describing multiple EduPage security issues, including an authorization bypass in the Payment module and impersonation attacks enabled by unsafe SVG handling and missing CSRF protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcelabs.infoguard.ch
Open sourceseclists.org
Open sourceseclists.org
Open sourcejkosik.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Openfind **MailGates/MailAudit** and **Sagredo qmail** were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. **CVE-2026-6350** affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (`CWE-121`) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a **CVSS v3.1** score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by **TWCERT/CC**. A second flaw, **CVE-2026-41113**, affects **Sagredo qmail** versions before `2026.04.07` and enables remote code execution through `tls_quit` because `qmail-remote.c` uses `popen` in the `notlshosts_auto` component, a command injection issue tracked as `CWE-78`. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request `#42`, and the patched `v2026.04.07` release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Jun 29, 2026
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026
Researchers disclosed three vulnerabilities affecting **Proxmox Virtual Environment (PVE)** and **Proxmox Mail Gateway (PMG)**, including a post-authentication reflected XSS in PVE’s API Inspector, a CRLF injection flaw in HTTP error handling, and a post-authentication SSRF plus arbitrary file-read issue shared across both products. The XSS bug, tracked as `CVE-2022-31358`, could let an authenticated attacker run JavaScript in a logged-in administrator’s browser and potentially abuse exposed web UI functions to execute actions on the host. The CRLF injection issue could be exploited in Chromium-based browsers to inject headers and trigger a client-side denial of service by forcing oversized cookie headers that lock users out of the web interface. The most serious finding was a bug chain in PVE and PMG that allowed low-privileged authenticated users to abuse SSRF and arbitrary file read; in PMG, attackers could also access backup archives containing the authentication private key, forge valid tickets, and escalate privileges to **`root@pam`**. MITRE assigned `CVE-2022-35507` and `CVE-2022-35508` to the latter flaws. Proxmox addressed the XSS in **`pve-http-server` 4.1-2** and patched the CRLF injection and SSRF-related issues in **`pve-http-server` 4.1-3**.
Jun 29, 2026