CVE-2026-27441 PDF Password CMDi

What is CVE-2026-27441?

CVE-2026-27441 is a critical command injection vulnerability in SEPPmail Secure Email Gateway, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.

Weakness: CWE-78

Which versions are affected by CVE-2026-27441?

It affects 1 product.

Products include Seppmail Seppmail.

How do I fix CVE-2026-27441?

No fix has been published for CVE-2026-27441 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-27441 being exploited?

There is no known exploitation of CVE-2026-27441 in the wild and no public exploit code.

Other vulnerabilities in SEPPmail Secure Email Gateway

• CVE-2026-2743 SEPPmail User Web Interface Arbitrary File Write to RCE Critical 10.0
• CVE-2026-27442 zip_attachments Path Traversal Critical 9.3
• CVE-2026-27443 S/MIME Decryption Tag Sanitization Bypass High 8.2
• CVE-2026-27444 Header Email Address Parsing High 7.8
• CVE-2026-2748 S/MIME Certificate Subject Whitespace High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f2gg-j592-6p52.