SEPPmail Secure Email Gateway versions earlier than 15.0.3 allow an attacker to inject arbitrary HTML content into notification e‑mails that inform users of new CA certificates. The injected markup can include malicious scripts, potentially leading to cross‑site scripting or phishing attacks within the email client. This flaw falls under the Cross‑Site Scripting weakness category (CWE‑79).

The affected product is SEPPmail Secure Email Gateway, applicable to all releases prior to 15.0.3. No other versions are listed as vulnerable.

The CVSS base score of 5.3 classifies the vulnerability as moderate. No EPSS score is available, and the issue is not recorded in the CISA KEV catalog, suggesting that immediate public exploitation is not known. Exploitation would require an attacker to influence the generation of CA‑certificate notification emails, which typically involves privileged access or the creation of a malicious certificate. Therefore, the opportunity for widespread exploitation is limited, but the impact within an organization that uses the gateway could be significant if the injection is not mitigated.