Axigen vulnerabilities
We track 6 vulnerabilities in Axigen products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Axigen vulnerabilities
- 7.5 High severity
Axigen Mail Server: Uncontrolled Recursion
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can
- 9.0 Critical severity
Axigen Mail Server: Improper Neutralization of Input During Web Page Generation
Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parameter in the Local Services Log page, (2) certificate file content in the SSL Cert
- 8.8 High severity
Axigen Mail Server: Cross-Site Request Forgery
Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s (breadcrumb) parameter. The application accepts state-changing requests via the
- 8.1 High severity
Axigen Mail Server: Improper Access Control
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endp
- 9.6 Critical severity
Axigen Mail Server: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
- 9.8 Critical severity
Axigen Mail Server: Incorrect Default Permissions
A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service (or add an account to Outlook or Gmail, etc.) with IMAP or POP3 without