CVE-2026-119762
Received Received - Intake

Unauthenticated Denial of Service in Axigen Mail Server

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119762
EUVD
EUVD-2026-114239

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Axigen Axigen Mail Server 10.0.0
Axigen Axigen Mail Server 10.6.0
Axigen Axigen Mail Server 10.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated denial of service flaw in Axigen Mail Server versions before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2. It occurs due to unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to crash SMTP, IMAP, POP3, and web services repeatedly.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in Axigen Mail Server services (SMTP, IMAP, POP3, WebMail, WebAdmin, WebMail Proxy) after receiving deeply nested SOAP/XML or JSON requests. Check server logs for repeated service failures or stack exhaustion errors. Use network monitoring tools to detect unusually large or malformed requests targeting these services.

Impact Analysis

This vulnerability allows attackers to crash critical email and web services by sending a specially crafted request. This can lead to service outages, loss of email functionality, and disruption of webmail or admin access. Repeated crashes may cause prolonged downtime and operational disruptions.

Mitigation Strategies

Immediately upgrade Axigen Mail Server to version 10.5.69, 10.6.40, or 10.7.2 or later. If upgrading is not immediately possible, restrict access to WebMail, WebAdmin, and WebMail Proxy listeners via firewall rules to limit exposure. Monitor incoming traffic for excessively large or deeply nested requests and block suspicious IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart