MailEnable Standard
CVE-2025-34417
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local foothold on Windows host
-
DeliveryGain write access to MailEnable install directory
-
ExploitPlant malicious MEAISO.DLL
-
ExecutionAdmin executable loads DLL on startup
-
ImpactExecute code with process privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires local access to the Windows host AND write permission to the MailEnable installation directory so the attacker can drop a malicious MEAISO.DLL that the administrative executable loads at startup. The practical limiting factor is that the installation directory (typically under Program Files) is normally writable only by privileged accounts, so this most realistically applies where directory ACLs are misconfigured/loosened or the product was installed to a world-writable path; it also requires the MailEnable administrative executable to subsequently be launched. It affects the MailEnable Standard edition per the CPE and does not provide any remote/network-triggerable path. |
| Impact | This is a genuine but lower-tier priority. The CVSS 4.0 base score of 8.5 (High) is driven by full VC:H/VI:H/VA:H impact, but the vector is explicitly local (AV:L) with low complexity (AC:L), requiring prior low privileges (PR:L) and no user interaction (UI:N) - so the high score reflects impact, not ease of remote reach. The EPSS score of 0.17% (6th percentile) is very low and is consistent with a local-only DLL-hijacking flaw that cannot be sprayed across the internet. There is no CISA KEV listing and no public exploit identified at time of analysis, so none of the signals indicate active or imminent widespread exploitation. The signals are therefore coherent rather than conflicting: high technical impact but constrained real-world reach. The practical gating factor - write access to the MailEnable installation directory - is not captured by the CVSS metrics alone, and is the main reason this should be triaged as a local privilege-escalation/persistence hardening issue rather than an emergency. Note the CWE-427 (uncontrolled search path) classification aligns cleanly with the described DLL-planting mechanism. |
| Exploit ScenarioDerived | An attacker who already has a foothold on the Windows host and can write to the MailEnable installation directory plants a malicious MEAISO.DLL. The next time the MailEnable administrative executable starts, it loads the attacker's DLL from the install directory without secure-search-order or integrity validation, running attacker code with the privileges of that process. No public exploit code is identified at time of analysis; a functional exploit is trivial to build given the straightforward DLL-hijack primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative executable loads MEAISO.DLL from its own installation directory without integrity validation or a hardened search order, allowing a malicious DLL dropped in that folder to run with the process's privileges. The attack is local-only and requires write access to the MailEnable installation directory plus a subsequent launch of the administrative executable; the practical limiting factor is that this directory (typically under Program Files) is normally writable only by privileged accounts, so realistic exposure is limited to hosts with misconfigured or loosened ACLs, or installations placed on world-writable paths. Per available intelligence, exploitation status is no public exploit identified at time of analysis, there is no CISA KEV listing, and EPSS is 0.17% (6th percentile), making this a genuine but lower-tier priority relative to network-reachable MailEnable flaws.
RemediationAI
Vendor-released patch: MailEnable Standard 10.54 - upgrade to 10.54 or later, following the vendor release notes at https://mailenable.com/Standard-ReleaseNotes.txt and the advisory at https://www.vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meaiso-dll. Because exploitation depends on write access to the MailEnable installation directory, the highest-value compensating control is to audit and tighten NTFS ACLs on that directory (and any path in the executable's DLL search order) so that only SYSTEM, Administrators, and the MailEnable service account retain write or modify permissions, removing inherited write access from Users and Authenticated Users; the trade-off is that service accounts requiring in-place updates or log writes may need explicit, narrowly scoped grants. Additionally, verify no unauthorized MEAISO.DLL or other unexpected DLLs exist in the installation tree and treat any such file as a compromise indicator, restrict local interactive logon and administrative tooling to trusted operators on the mail server, and monitor for DLL creation events in MailEnable directories. Note that these mitigations reduce preconditions but do not fix the underlying unsafe load; only the 10.54 or later upgrade removes the flaw, and blocking network ports or disabling TCP services will not address this local-only issue.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic uncontrolled search path element issue (CWE-427, DLL hijacking / DLL planting). Instead of loading MEAISO.DLL from a trusted absolute path or validating the loaded module's integrity (signature, hash, or trusted directory), the MailEnable administrative executable resolves the library name using an insufficiently secured search order that includes its own installation directory. Any process that can create a file named MEAISO.DLL in that directory can therefore satisfy the load request and have its code executed inside the administrative process at startup. The affected CPE identifies the MailEnable Standard edition (cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*) for all versions prior to 10.54. The independently assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (local, low complexity, low privileges required, no user interaction, high confidentiality, integrity, and availability impact within the vulnerable component), which is consistent with the reported CVSS 4.0 score of 8.5 and its PR:L/AV:L attributes. There is no remote or network-triggerable exploitation path in the available data; the code executes with the privileges of the administrative process rather than escalating beyond them.
Know when Mailenable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL planting (AV:L) needing a low-privileged foothold with write access to the install directory (PR:L), no scope change, yielding full code execution so C/I/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAISO.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAISO.DLL, which is then loaded when the executable starts, resulting in execution of attacker-controlled code with the privileges of the process.
Executive ViewAI
MailEnable Standard installations older than version 10.54 contain a DLL-loading weakness in the administrative executable that can let code run with that process's privileges, but only after an attacker already has local write access to the product's installation folder and can trigger the admin tool. Because that folder normally sits under Program Files and is writable only by administrators or SYSTEM, the practical risk is concentrated on servers where folder permissions have been loosened, where the product was installed onto a shared or world-writable path, or where a lower-privileged account already has a foothold. Leadership should treat this as a contained, configuration-dependent hardening issue rather than an imminent external threat, while confirming that no MailEnable host is running with weakened directory permissions.
No vendor-released patch identified at time of analysis; interim mitigations are to harden ACLs on the MailEnable installation directory so only SYSTEM and local Administrators hold Write/Modify rights, ensure the product is not installed on world-writable or share-hosted paths, monitor and alert on unexpected MEAISO.DLL or other DLL placement in that folder, apply application whitelisting or DLL-load restrictions to the MailEnable administrative executable, and limit interactive logon access to affected hosts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Mailenable
View allXSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged W
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installatio
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.D
Local DLL hijacking in MailEnable versions prior to 10.54 allows an attacker who can already write to the product's inst
GitHub PoC
Exploit-DB