This vulnerability (CVE-2026-44128) affects SEPPmail AG Secure Email Gateway prior to version 15.0.2.1. It arises from improper neutralization of directives in dynamically evaluated code (CWE-95), specifically eval injection in Perl code within the new GINA UI. An unauthenticated attacker can supply malicious input to an endpoint parameter that is directly passed to Perl's eval, enabling remote code execution without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote code execution on the affected system, potentially compromising confidentiality, integrity, and availability of the Secure Email Gateway. This could lead to full system compromise or disruption of email services. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor SEPPmail AG communications for updates. Until a fix is available, consider restricting network access to the affected interface and applying compensating controls to limit exposure.