This vulnerability (CVE-2026-44128) affects SEPPmail AG's Secure Email Gateway prior to version 15.0.2.1. It arises from improper neutralization of directives in dynamically evaluated code (CWE-95), specifically in the new GINA UI component. An endpoint accepts attacker-controlled input from a parameter and passes it directly to Perl's eval function without proper sanitization, enabling unauthenticated remote code execution. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of the Secure Email Gateway. This can result in unauthorized access, data manipulation, or disruption of email services. The vulnerability is critical due to the ease of exploitation and the severity of impact on confidentiality, integrity, and availability.

No official patch or remediation level has been published by SEPPmail AG as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected service and monitor for suspicious activity related to the GINA UI. Avoid exposing the vulnerable interface to untrusted networks.