Vulnerability · Published Nov 4, 2026 · Assigned by NCSC.ch
CVE-2026-114426Pre-authentication upload parsing permits resource exhaustion
High 8.7
In plain English
A high-severity uncontrolled resource consumption in SEPPmail Secure Email Gateway (SEG) from SEPPmail AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SEPPmail AG | SEPPmail Secure Email Gateway (SEG) | 0 – before 15.1.1 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N