SEPPmail Secure Email Gateway fails to verify that a PGP signature was generated by the expected key. An attacker can craft a message with a forged signature that will be accepted by the system, making the message appear authentic. This undermines the integrity and authenticity guarantees of email communications and can be leveraged for phishing, man‑in‑the‑middle attacks, or other social‑engineering tactics. The weakness is a failure to enforce proper cryptographic signature validation, identified as CWE-347.

The vulnerability affects SEPPmail Secure Email Gateway deployments running any version prior to 15.0.1, including all releases labeled simply "SEPPmail" and those marketed as the Secure Email Gateway component. No later versions are affected.

The CVSS score of 6.9 indicates moderate severity; combined with an EPSS score of less than 1 % the likelihood of widespread exploitation is low. The vulnerability has not been listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet. Exploitation appears possible remotely by sending a crafted PGP‑signed email to the vulnerable gateway; no local privileges or additional access are required beyond normal email submission rights. The attack vector is therefore likely network‑based via the email ingestion interface.