CVE-2026-114421
Description
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
Is your site exposed to CVE-2026-114421?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-114421? +
How do I check if I'm vulnerable to CVE-2026-114421? +
Related Vulnerabilities
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes …
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a …
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL …
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a …
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and …
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An …
