SEPPmail Secure Email Gateway before version 15

CVE-2026-44127 is an unauthenticated path traversal / local file read in SEPPmail Secure Email Gateway before 15.0.4, specifically in the identifier parameter of /api.app/attachment/preview. InfoGuard shows the handler prepends /tmp/ and then trusts attacker-controlled path input, allowing traversal to arbitrary local files; after reading, it also attempts to delete the parent folder. The vulnerable surface sits in GINA V2 / api.app, not the classic core mail flow.

In practice this is serious but not universal. The impact is strong—InfoGuard says attackers can pull mail content, LDAP data, password hashes, and keys from the appliance—but the biggest real-world brake is deployment friction: GINA V2 requires explicit activation and is off by default in SEPPmail documentation. So this is not a blanket 'all SEPPmail boxes are instant internet loot' event; it is a high-priority exposure check for internet-facing GINA V2 deployments.

Why this verdict

• Pre-auth remote read on a mail gateway: no authentication, no user interaction, and direct access to a sensitive appliance role raises the floor immediately.
• Exposure is narrowed by product configuration: SEPPmail documents Use the new GINA V2x as inactive by default, so this is not equally reachable across the whole installed base.
• Not RCE, and deletion is privilege-limited: the remove_folder side effect matters, but InfoGuard notes the process runs as nobody, which sharply limits destructive outcomes compared with true admin-level arbitrary file delete.

Why not higher?

This is not an instant-own primitive. There is no demonstrated remote code execution in this CVE alone, and the deletion side effect is bounded by the low-privilege runtime context. The biggest downgrade pressure is that GINA V2 must be explicitly enabled, which materially shrinks the exposed population.

Why not lower?

If you do run exposed GINA V2, this is an unauthenticated file-read bug against an email security gateway, which is one of the worst places to leak secrets from. The appliance can hold message content, directory data, hashes, and key material; that blast radius is too meaningful for a MEDIUM backlog item.

1. Restrict GINA V2 exposure — Put api.app behind VPN, reverse-proxy allowlists, or partner-only source controls where business workflow allows. For a HIGH verdict, deploy this within 30 days on any internet-facing SEPPmail instance that cannot be patched immediately.
2. Enable IPS/WAF signatures for traversal — Use product-aware protections that inspect requests to /api.app/attachment/preview and block traversal patterns in identifier; Check Point already ships a dedicated signature. Treat this as an interim reduction step and get it in place within 30 days.
3. Disable GINA V2 if unused — If the organization does not actively need the new GINA V2 workflow, turning it off removes the vulnerable surface entirely. Because SEPPmail documents it as an explicit setting, this is often the cleanest compensating control to apply within 30 days.
4. Monitor preview endpoint abuse — Alert on repeated hits to /api.app/attachment/preview, URL-decoding anomalies, and traversal tokens such as ../ or encoded equivalents. This will not stop first exploitation, but it gives you a chance to scope internet noise and verify whether exposed systems are being probed within the 30-day mitigation window.

Run this on the SEPPmail appliance itself from a local console or support shell. Save it as check_cve_2026_44127.sh, run chmod +x check_cve_2026_44127.sh && ./check_cve_2026_44127.sh; no root is required for the basic file checks, but a privileged shell improves coverage if version files are restricted.

#!/usr/bin/env bash
# check_cve_2026_44127.sh
# Purpose: Determine whether a SEPPmail appliance appears vulnerable to CVE-2026-44127
# Logic: Find installed firmware version from common local markers and compare to 15.0.4
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_FIXED="15.0.4"
FOUND_VERSION=""

extract_version() {
  sed -nE 's/.*([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?).*/\1/p' "$1" 2>/dev/null | head -n1
}

# Compare dotted versions: returns 0 if $1 >= $2
version_ge() {
  awk -v A="$1" -v B="$2" '
    function splitver(v, arr,   i, n, t) {
      n = split(v, t, ".")
      for (i = 1; i <= 4; i++) arr[i] = (i <= n ? t[i] + 0 : 0)
    }
    BEGIN {
      splitver(A, a); splitver(B, b)
      for (i = 1; i <= 4; i++) {
        if (a[i] > b[i]) exit 0
        if (a[i] < b[i]) exit 1
      }
      exit 0
    }'
}

# Common candidate files on appliance-like systems
CANDIDATES=(
  "/etc/version"
  "/etc/seppmail-release"
  "/etc/motd"
  "/usr/local/etc/seppmail-release"
  "/usr/local/share/seppmail/version"
  "/opt/seppmail/version"
)

for f in "${CANDIDATES[@]}"; do
  if [ -r "$f" ]; then
    v="$(extract_version "$f")"
    if [ -n "$v" ]; then
      FOUND_VERSION="$v"
      break
    fi
  fi
done

# Optional fallback: try local web root files if present
if [ -z "$FOUND_VERSION" ]; then
  for f in /var/www/htdocs/index.html /var/www/htdocs/*.html /usr/local/www/htdocs/*.html; do
    [ -r "$f" ] || continue
    v="$(extract_version "$f")"
    if [ -n "$v" ]; then
      FOUND_VERSION="$v"
      break
    fi
  done
fi

if [ -z "$FOUND_VERSION" ]; then
  echo "UNKNOWN - could not determine installed SEPPmail firmware version from local markers"
  exit 2
fi

if version_ge "$FOUND_VERSION" "$TARGET_FIXED"; then
  echo "PATCHED - detected SEPPmail version $FOUND_VERSION (fixed in $TARGET_FIXED or later)"
  exit 0
else
  echo "VULNERABLE - detected SEPPmail version $FOUND_VERSION (fixed in $TARGET_FIXED)"
  exit 1
fi

Sources

1. NVD entry for CVE-2026-44127
2. InfoGuard Labs technical write-up
3. SEPPmail 15.0 release notes
4. SEPPmail docs: Change GINA settings
5. SEPPmail docs: Home / firmware version
6. Check Point IPS advisory for CVE-2026-44127
7. CISA Known Exploited Vulnerabilities Catalog
8. Third-party EPSS mirror for percentile context