SEPPmail Secure Email Gateway versions prior to 15.0.1 decrypt inline PGP messages while still exposing surrounding unencrypted content. This flaw permits an attacker who can send or intercept such emails to read sensitive data that was intended to remain confidential. The weakness is a classic example of improper isolation of encrypted data, classified as CWE‑200.

The vulnerability affects SEPPmail Secure Email Gateway, specifically all releases before 15.0.1. Users running any version older than 15.0.1 are susceptible to data exposure from mixed PGP/plaintext messages.

The CVSS base score of 6.9 indicates a moderate to high impact. EPSS is listed as less than 1 percent, suggesting that exploitation is currently unlikely, and the vulnerability is not in the CISA KEV catalog. Based on the description, the most probable attack vector involves an adversary inserting a mixed‑content message into the email stream that the gateway will process, thereby leaking data to the attacker.