CVE-2026-119761 Details
Description
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
A stored cross-site scripting vulnerability has been identified in Axigen Mail Server WebMail versions prior to 10.6.39 and 10.7.1. This vulnerability allows unauthenticated remote attackers to inject scripts via unescaped sender display names in the conversation view. When the recipient opens the folder with conversation view enabled, the injected script executes, potentially leading to theft or redirection of mailbox content.
Users can update to Axigen Mail Server versions 10.6.39 or 10.7.1. Instructions for updating are available on the Axigen website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.axigen.com/kb/show/411 | [email protected] | Technical DescriptionVendor |
| https://www.axigen.com/updates/axigen-10.6.39 | [email protected] | Release NotesVendor |
| https://www.axigen.com/updates/axigen-10.7.1 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/axigen-mail-server-before-10.6.39-and-10.7.1-stored-xss-via-sender-display-name | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Axigen Mail Server | >= 10.5.0, < 10.6.39 (semver) >= 10.7.0, < 10.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |