CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 insecurely deserializes attacker-controlled data (CWE-502) in a privileged REST import workflow without adequate validation, enabling command injection (CWE-78). The flaw is triggered when an attacker holding a privileged API token submits crafted serialized data to the gateway's REST import function. Successful exploitation yields execution of arbitrary operating-system commands on the appliance under the low-privilege 'nobody' account, though the CVSS 4.0 scoring still rates the confidentiality, integrity and availability impact as high. All deployments running versions earlier than 15.0.6, typically enterprise and service-provider email-security appliances, are affected, particularly where the REST API is reachable by third parties or where privileged API tokens may be compromised. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates only about a 0.6% probability of exploitation within 30 days.

What to do: Upgrade to SEPPmail Secure Email Gateway 15.0.6 or later. Until patched, restrict access to the REST API (e.g., management-network allowlisting), apply least-privilege to and rotate any privileged API tokens, and review appliance logs for unexpected import activity or commands executed as 'nobody'.