This vulnerability (CVE-2026-29144) affects SEPPmail Secure Email Gateway before version 15.0.3. It is caused by improper input validation (CWE-20) that enables attackers to circumvent subject sanitization mechanisms. By leveraging Unicode lookalike characters, attackers can forge security tags within email subjects, potentially compromising the email gateway's security controls. The CVSS 4.0 base score is 7.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high scope impact.

Successful exploitation allows attackers to bypass subject sanitization and forge security tags, which may lead to compromised email security features such as trust indicators or filtering mechanisms. This could result in malicious emails being treated as legitimate or trusted, increasing the risk of phishing or other email-based attacks. There is no evidence of exploitation in the wild at this time.

No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should monitor vendor communications for updates and consider additional email filtering or inspection controls to detect suspicious Unicode characters in email subjects.