MailEssentials vulnerabilities

2 known vulnerabilities in MailEssentials from Gfi. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  MailEssentials: Deserialization of Untrusted Data

  CVE-2025-34491Apr 28, 2025Gfi

  GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup.

• 7.8 High severity

  MailEssentials: Deserialization of Untrusted Data

  CVE-2025-34489Apr 28, 2025Gfi

  GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.