The vulnerability in SEPPmail Secure Email Gateway before version 15.0.6 permits an attacker who can send data to the privileged REST import workflow to perform arbitrary command execution. The flaw stems from deserialization of attacker‑controlled data without adequate validation, allowing command injection. An attacker holding a privileged API token can execute commands with the "nobody" user, potentially compromising configuration, exfiltrating data, or enabling lateral movement.

Affected systems are SEPPmail AG’s SEPPmail Secure Email Gateway (SEG). All installations running a version earlier than 15.0.6 are impacted, especially those that expose the REST import API and have privileged API tokens in use.

With a CVSS score of 8.6 the vulnerability is classified as high severity. Exploitation requires the attacker to possess a privileged API token and access the REST import endpoint. The EPSS score is not available and the issue is not yet listed in the CISA KEV catalog, but the combination of high score and privilege requirement indicates a significant risk for insiders or compromised credentials.