Read the docs
TI-2026-83256 Aliases CVE-2026-119762GHSA-r369-45gr-q63m

Axigen Mail Server crash via deeply nested unauthenticated requests

Priority MEDIUM 44CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service flaw. Unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication causes uncontrolled recursion (CWE-674). An unauthenticated remote attacker can send one deeply nested request to the WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and repeatedly crash the SMTP, IMAP, POP3, and web services.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Fixed Axigen Mail Server (Axigen): 10.5.69, 10.6.40, 10.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AxigenAxigen Mail Server10.0.0 to before 10.5.69; 10.6.0 to before 10.6.40; 10.7.0 to before 10.7.210.5.69, 10.6.40, 10.7.2Patch availableCNA
  • Axigen Mail Server VendorAxigen Affected 10.0.0 to before 10.5.69; 10.6.0 to before 10.6.40; 10.7.0 to before 10.7.2 Fixed in 10.5.69, 10.6.40, 10.7.2 Patch available CNA

Remediation

Upgrade to Axigen Mail Server 10.5.69, 10.6.40, or 10.7.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA Axigen Mail Server (Axigen) Fixed in 10.5.69, 10.6.40, 10.7.2

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119762
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Alias added: GHSA-r369-45gr-q63m

References

Advisory 1

Other 2

  • TI-2025-42192 Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS)… CVSS 3.1CRITICAL 9.0
  • TI-2025-42191 Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request… CVSS 3.1HIGH 8.8
  • TI-2025-42190 Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in… CVSS 3.1HIGH 8.1
  • TI-2022-13396 An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen… CVSS 3.1MEDIUM 6.1
  • TI-2023-09397 A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox… CVSS 3.1CRITICAL 9.8
  • TI-2020-16367 An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before… CVSS 3.1CRITICAL 9.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences