SEPPmail Secure Email Gateway before version 15.0.3 contains an input validation flaw (CWE-20) that permits attackers to bypass subject sanitization controls. This enables forging of email tags like [signed OK], potentially misleading users about email authenticity. The vulnerability has a CVSS 4.0 score of 7.7 (high severity) with network attack vector, no privileges required, no user interaction, and high scope impact. No patch or remediation details are provided in the vendor or CVE data. The vulnerability is not known to be exploited in the wild and affects on-premises deployments only.

An attacker can manipulate email subject fields to forge tags such as [signed OK], which may cause recipients to trust malicious or spoofed emails. This undermines the integrity of email authenticity indicators provided by SEPPmail Secure Email Gateway. The vulnerability could facilitate phishing or social engineering attacks by presenting forged trust indicators. There is no evidence of active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor SEPPmail communications for updates. Until a fix is available, consider additional email validation controls or user awareness to mitigate risks from forged email tags.