CVE-2026-2743 is a critical (CVSS 9.8) arbitrary file write through path traversal in the large file transfer feature of the SEPPmail User Web Interface, leading to remote code execution. SEPPmail 15.0.2.1 and before are affected. Update to the latest 15.0 release the vendor lists.
What's affected
SEPPmail 15.0.2.1 and before, per the record. The affected feature is large file transfer, which the InfoGuard write up says most customers enable.
The SEPPmail 15.0 release notes list the fix under a 15.0.3 entry, and describe a path traversal in file.app used by the Outlook add-in. The InfoGuard write up lists 15.0.4 as the version for this CVE in its table. Those two sources differ, so install the newest 15.0.x release and confirm the fix against the release notes.
How to check if you're exposed
Open the SEPPmail admin interface and read the installed version. Anything at 15.0.2.1 or older is affected. Next, check whether the User Web Interface and large file transfer are reachable from the internet, since that is how an unauthenticated attacker would arrive.
Review the appliance's configuration files for unexpected changes, and compare with a known good backup if you have one.
What to do now
- Update SEPPmail to the newest 15.0.x release and read the release notes for CVE-2026-2743.
- Restrict access to the User Web Interface to the networks that need it, or disable large file transfer if you can live without it.
- Review the appliance for unexpected configuration changes and unexpected processes.
- If the interface was exposed for long, treat it as potentially compromised and follow your incident process.
- Plan the other SEPPmail fixes from the same release notes, since they list several further CVEs.
Why it matters
The record lists CWE-22 (path traversal) and CWE-434 (unrestricted file upload). Chunked uploads were stored in a temporary directory, and a crafted path could place a file elsewhere. InfoGuard's write up says a writable system configuration file could be turned into code execution.
An email security gateway sits at the edge and handles sensitive mail. A pre authentication flaw there is a priority. The record does not mark this CVE as known exploited.
Quick check
Which version fixes it?
The vendor release notes show it closed in the 15.0.3 entry, while a researcher table lists 15.0.4. Install the newest 15.0.x and confirm.
Sources
- CVE-2026-2743 on Gold
- SEPPmail 15.0 release notes, fetched: https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html
- InfoGuard Labs write up, fetched: https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/
Last reviewed: 19 October 2026.
