EUVD-2026-114238: Axigen Mail Server WebMail stored XSS reported via sender display names
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Axigen
- Product
- Axigen Mail Server WebMail
- First seen
Summary
The EUVD listing (CVSS 5.3) says Axigen Mail Server WebMail before 10.6.39 and 10.7.1 has a stored cross-site scripting flaw that lets unauthenticated remote attackers inject script through unescaped sender display names. The listing is the only source cited.
If you use Axigen
Upgrade Axigen WebMail to 10.6.39, 10.7.1, or a later release
Avoid opening messages in the conversation view from untrusted senders until patched
Review WebMail logs for unusual script or HTML content in sender names
Upgrade to Axigen 10.5.69, 10.6.40, 10.7.2, or a later release
Restrict access to the Axigen SOAP and JSON interfaces until patched
Monitor the mail server for service interruptions
What the sources say 2
· Mastodon: “Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSO...” Source
· Mastodon: “Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation vie...” Source