SEPPmail Secure Email Gateway versions before 15.0.1 fail to sanitize headers extracted from S/MIME protected MIME entities. The flaw, a classic input validation issue identified as CWE‑20, allows an attacker to inject or alter trusted email headers. If successful, the gateway may process emails with forged metadata, potentially enabling spoofed sender addresses, bypassing authentication checks, or influencing subsequent mail handling, thereby compromising email integrity and possibly confidentiality.

Affected systems include all SEPPmail Secure Email Gateway deployments running a version earlier than 15.0.1. The vulnerability applies to the secure email gateway product released by SEPPmail, as documented by the vendor in their advisory.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, implying no publicly known widespread attacks. Despite the low probability, the most plausible attack vector is remote, via an attacker sending a crafted S/MIME encrypted message to the gateway that exploits the header sanitization failure. Successful exploitation would allow the attacker to control headers that the gateway treats as trusted, creating a risk of email spoofing or bypassing security controls.