Stored Cross-Site Scripting in Axigen Mail Server Affects Remote User Security
CVE-2026-119761

5.3MEDIUM

Key Information:

Vendor

Axigen

Status
Axigen Mail Server
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119761?

Axigen Mail Server prior to versions 10.6.39 and 10.7.1 is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue allows untrusted remote attackers to inject malicious scripts using unescaped sender display names within the conversation view. By crafting an email with HTML and script within the From display name, an attacker can execute the script upon the recipient accessing the mailbox, potentially leading to unauthorized access and theft of sensitive mailbox content.

Affected Version(s)

Axigen Mail Server 10.5.0 < 10.6.39

Axigen Mail Server 10.7.0 < 10.7.1

References

https://www.axigen.com/kb/show/411
vendor-advisory
https://www.axigen.com/updates/axigen-10.6.39
release-notes
https://www.axigen.com/updates/axigen-10.7.1
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cristian Draghici and Gabriel Cotruta of Axigen Security Team
.