SEPPmail Secure Email Gateway before version 15.0.1 accepts S/MIME certificates whose subject fields contain whitespace, allowing an attacker to forge email signatures that appear to come from legitimate users. This compromise of message authenticity can enable phishing, man‑in‑the‑middle attacks or social engineering. The flaw arises from improper validation of the certificate subject, a weakness classified as CWE‑295.

The vulnerability affects SEPPmail Secure Email Gateway installations running any version earlier than 15.0.1. Affected products include SEPPmail Secure Email Gateway as identified by the vendor and the corresponding CPE entries.

The CVSS score of 7.8 indicates a high impact if exploited, yet the EPSS score of less than 1% means the likelihood of real‑world exploitation is low. The flaw is not listed in the CISA KEV catalog, so no known public exploits are documented. The likely attack vector is remote, via manipulation of S/MIME messages over the network, and exploitation requires an attacker to supply a certificate with a subject that contains whitespace. Once in place, the attacker can impersonate an addressed user by forging signatures that the gateway will accept as valid.