XML External Entity Processing Vulnerability in MailEnable by MailEnable
CVE-2026-114552

6.5MEDIUM

Key Information:

Vendor

Mailenable

Status
Mailenable
Vendor
CVE Published:
3 November 2026

What is CVE-2026-114552?

The vulnerability in MailEnable arises from improper handling of XML External Entity (XXE) references within the parseObjectResponse method. This flaw permits remote attackers to gain unauthorized access to sensitive data present in the system. Exploitation of this security issue requires user authentication, allowing attackers to read sensitive information associated with the service account, thereby posing a serious security risk to affected installations of MailEnable.

Affected Version(s)

MailEnable 10.59

References

https://www.zerodayinitiative.com/advisories/ZDI-26-811/
x_research-advisory

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.