CVE-2026-27441 is a critical (CVSS 9.8) OS command injection in SEPPmail Secure Email Gateway before version 15.0.1. The PDF encryption password is not neutralized, which allows OS command execution. Update to 15.0.1 or later and read the vendor's disclosure notes.
What's affected
SEPPmail Secure Email Gateway before 15.0.1, per the record. The vendor's 15.0 release notes list this issue as PDF Password CMDi under a vulnerability disclosure entry that also names several other CVEs.
Update to the newest 15.0.x release, which includes earlier fixes cumulatively as release notes show.
How to check if you're exposed
Read the version in the SEPPmail admin interface. Below 15.0.1 is affected. Then consider whether PDF encryption for outbound mail is enabled and who can set the password that feeds it, since that is the vulnerable input.
What to do now
- Update SEPPmail to the newest 15.0.x release.
- Read the vulnerability disclosure section of the release notes and check which other CVEs apply to your version.
- Review who can set or influence PDF encryption passwords and limit it.
- Check the appliance for unexpected changes if it was exposed before the update.
- Subscribe to vendor release notes so patches do not wait for the next audit.
Why it matters
The weakness is CWE-78, OS command injection. A password value was placed into an operating system command without proper neutralization, so special characters in it could change the command.
Passwords seem harmless, yet they are just user input. Anything that reaches a shell must be quoted or passed as an argument array. The record does not mark this CVE as known exploited.
Quick check
Where does the injection happen?
In the handling of the PDF encryption password, according to the record.
Sources
- CVE-2026-27441 on Gold
- SEPPmail 15.0 release notes, fetched: https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure
Last reviewed: 19 October 2026.
