Unauthenticated Denial of Service Vulnerability in Axigen Mail Server
CVE-2026-119762

8.7HIGH

Key Information:

Vendor

Axigen

Status
Axigen Mail Server
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119762?

The Axigen Mail Server is susceptible to an unauthenticated denial of service attack due to unbounded nesting depth when processing SOAP/XML and JSON request bodies prior to authentication. Attackers can exploit this vulnerability by sending a single request with deeply nested structures to the WebMail, WebAdmin, or WebMail Proxy interfaces. This can result in stack exhaustion, leading to repeated crashes of SMTP, IMAP, POP3, and web services.

Affected Version(s)

Axigen Mail Server 10.0.0 < 10.5.69

Axigen Mail Server 10.6.0 < 10.6.40

Axigen Mail Server 10.7.0 < 10.7.2

References

https://www.axigen.com/kb/show/412
vendor-advisory
https://www.axigen.com/updates/axigen-10.6.40
release-notes
https://www.axigen.com/updates/axigen-10.7.2
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitri Kaslov & rootkiTED
Cristian Draghici and Gabriel Cotruta of Axigen Security Team
.