CVE-2026-84832: CWE-502 Deserialization of untrusted data in SEPPmail AG SEPPmail Secure Email Gateway (SEG)

CVE-2026-84832 is a deserialization of untrusted data vulnerability (CWE-502) in SEPPmail Secure Email Gateway (SEG) prior to version 15.0.6. The vulnerability occurs in a privileged REST import workflow where attacker-controlled data is deserialized without sufficient validation. An attacker possessing a privileged API token can exploit this to execute arbitrary commands with limited "nobody" user privileges. The CVSS 4.0 base score is 8.6, indicating a high-severity issue with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with a privileged API token can execute arbitrary commands on the affected system with "nobody" privileges. This could lead to unauthorized actions within the context of the application, potentially compromising system integrity and availability. The impact is limited by the privilege level "nobody," but still represents a significant security risk.

Upgrade SEPPmail Secure Email Gateway to version 15.0.6 or later where this vulnerability is fixed. Since this is a software vulnerability and not a cloud service, patching the affected software version is required. Patch status is confirmed by the version boundary provided. No vendor advisory content was provided, so check SEPPmail AG's official advisories for the latest remediation details.