SEPPmail Secure Email Gateway versions prior to 15.0.1 fail to properly neutralize PDF encryption passwords, allowing an attacker to inject operating‑system commands into the password field. This flaw is classified as CWE‑78, a command injection weakness, and could enable an attacker to execute arbitrary commands on the host that runs the gateway service.

The vulnerability affects SEPPmail Secure Email Gateway installations running any version earlier than 15.0.1. No other SEPPmail products are listed as impacted.

The CVSS score of 9.5 indicates a severe vulnerability, while an EPSS score of fewer than 1% suggests that, so far, exploitation has been unlikely or not observed. The flaw is not listed in CISA’s KEV catalog. Although the description does not state the attack surface, the likely vector is remote: an attacker can deliver a specially crafted PDF attachment via email that the gateway processes, triggering the command injection. Because the gateway often operates with elevated privileges, successful exploitation could allow full compromise of the underlying system.