The vulnerability arises from insecure deserialization of untrusted data in SEPPmail Secure Email Gateway. An attacker with network access can supply a crafted serialized object through the GINA UI, causing the application to execute arbitrary code on the gateway server. This satisfies the conditions of CWE-502, enabling an unauthenticated user to gain full control of the affected system.

Affected systems are installations of SEPPmail Secure Email Gateway earlier than version 15.0.4. The issue was fixed in the 15.0.4 release, so all earlier versions remain vulnerable. Enterprises using the Secure Email Gateway should verify their current version and upgrade if necessary.

The CVSS score of 9.2 classifies the flaw as critical, and although no EPSS value is available, the lack of KEV listing does not diminish the risk. The entry is reachable through the GINA UI, which is typically accessible over the network, suggesting that remote attackers can exploit the flaw without authentication. Given the severity and the absence of any mitigation in the product, patching is imperative.