SEPPmail Secure Email Gateway before version 15.0.3 accepts Unicode characters that look like standard ASCII in the subject field. This allows an attacker to bypass the gateway’s subject sanitization and forge security tags that the system uses for filtering or forwarding. The result is that the attacker can misrepresent an email’s security status, potentially causing the message to be treated as legitimate even though it should be flagged or blocked.

The vulnerability affects the SEPPmail Secure Email Gateway product from SEPPmail, specifically any installations running versions earlier than 15.0.3. The affected component is the subject parsing and sanitization routine that interprets Unicode characters as if they were plain ASCII tags.

With a CVSS score of 7.8 the flaw is considered high severity. The exploit would be performed by sending a specially crafted email that uses lookalike Unicode characters in the subject line. EPSS data are not available, and the flaw is not listed in the CISA KEV catalog, so there is no confirmed public exploitation yet, but the vulnerability remains a significant risk pending an update.