The vulnerability identified as CVE-2026-44125 affects SEPPmail AG Secure Email Gateway prior to version 15.0.4. It involves missing authorization enforcement on several endpoints within the new GINA UI, permitting unauthenticated remote attackers to access restricted functionality without a valid session. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet published an official fix or remediation guidance, and no patch links are available. The product is not a cloud service, so remediation depends on vendor updates to on-premises software.

Successful exploitation allows unauthenticated remote attackers to bypass authorization controls and access sensitive functionality within the Secure Email Gateway's GINA UI. This could lead to unauthorized access to administrative or user functions, potentially compromising confidentiality, integrity, and availability of the email gateway environment. The critical CVSS score reflects the severity of this impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, organizations should monitor SEPPmail AG communications for updates. Until a patch is released, restricting network access to the affected endpoints and applying compensating controls where possible may reduce exposure.