SEPPmail AG Secure Email Gateway prior to version 15.0.4 contains a CWE-502 vulnerability due to insecure deserialization of untrusted data reachable through the new GINA UI. This flaw enables unauthenticated remote attackers to execute arbitrary code by submitting specially crafted serialized objects. The vulnerability is rated critical with a CVSS 4.0 score of 9.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected system, potentially leading to full compromise of the Secure Email Gateway. The vulnerability impacts confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the new GINA UI interface if possible and monitor for suspicious activity related to deserialization attempts. Avoid exposing the vulnerable service to untrusted networks.