SEPPmail Secure Email Gateway before version 15.0.3 suffers from improper input validation (CWE-20) related to the handling of S/MIME-encrypted MIME entities. Specifically, the product fails to properly authenticate the inner message, which enables an attacker to control trusted headers within the email. This can undermine the trust model of secure email communications by allowing header manipulation despite encryption. The vulnerability is remotely exploitable without authentication or user interaction, with low complexity and limited impact on confidentiality but high impact on system integrity.

An attacker can manipulate trusted email headers by exploiting the improper authentication of inner S/MIME-encrypted messages. This could lead to spoofing or bypassing of security controls that rely on header integrity. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 15.0.3, upgrading to version 15.0.3 or later is likely the intended fix once officially released. Until a patch is confirmed, organizations should monitor vendor communications for updates and consider additional email security controls to detect header manipulation.