Read the docs
TI-2025-27103 Aliases CVE-2025-40632GHSA-qxgw-cmmh-8chh

Cross-site scripting (XSS) vulnerability in IceWarp Mail Server

Priority LOW 10CWE-79Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IceWarpIcewarp Mail Server11.4.0—No fix listedCNA
  • Icewarp Mail Server VendorIceWarp Affected 11.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:icewarp:mail_server:11.4.0:*:*:*:*:*:*:*11.4.0VulnerableIceWarp
  • cpe:2.3:a:icewarp:mail_server:11.4.0:*:*:*:*:*:*:* Versions 11.4.0 Vulnerable ·IceWarp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40632
  2. 2026-10-03 Alias added: GHSA-qxgw-cmmh-8chh

References

Advisory 1

  • TI-2023-20749 IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI)… CVSS 3.1CRITICAL 9.8
  • TI-2015-01363 Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow… CVSS 3.0HIGH 7.5
  • TI-2019-09404 IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via… CVSS 3.0HIGH 7.5
  • TI-2021-14809 Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2… CVSS 3.1MEDIUM 6.1
  • TI-2020-11018 IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are… CVSS 3.1HIGH 8.8
  • TI-2011-03155 server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote… CVSS 2.0MEDIUM 6.4
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences