Axigen Mail Server: Unauthenticated denial of service via deeply nested requests
Summary
Axigen Mail Server versions before 10.5.69, 10.6.x before 10.6.40 and 10.7.x before 10.7.2 fail to limit the nesting depth of SOAP/XML and JSON request bodies before authentication. An unauthenticated remote attacker can send a single deeply nested request to the WebMail, WebAdmin or WebMail Proxy listeners to exhaust the stack and crash the server process. The crash interrupts SMTP, IMAP, POP3 and web services, and repeated requests can keep the server unavailable.
Affected
- Axigen Mail Server 10.0.x to before 10.5.69
- Axigen Mail Server 10.6.x to before 10.6.40
- Axigen Mail Server 10.7.x to before 10.7.2
- Older branches (9.x and below): Unknown.
Fixed in
- 10.5.69
- 10.6.40
- 10.7.2
Workaround
Unknown. No vendor workaround is documented; patching is the remediation. Until patched, restrict WebMail, WebAdmin and WebMail Proxy access to trusted networks or a VPN.
Exploitation
- Not known to be exploited according to OffSeq; the CISA SSVC assessment lists exploitation as none.
- No public proof of concept found.
- A public scanner template can locate exposed instances.
- The VulDB "0-Day" label is undefined and unclear.
Our recommendation
- Identify all Axigen instances and their versions, including any 9.x or older installations.
- Upgrade to 10.5.69, 10.6.40 or 10.7.2, depending on the branch, after checking the vendor advisory.
- Restrict WebMail, WebAdmin and WebMail Proxy access to trusted networks or a VPN until patched.
- Monitor for crashes or restarts of the mail services.
- Upgrading to these versions also covers CVE-2026-119761 (stored XSS in WebMail, same release).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Axigen KB: CVE-2026-119762 www.axigen.com
- Axigen 10.6.40 Update www.axigen.com
- Axigen 10.7.2 Update www.axigen.com
- VulnCheck advisory www.vulncheck.com
- VulDB 429274 vuldb.com
- OffSeq radar: CVE-2026-119762 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:23.
Original description (NVD)
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.