MailEnable
CVE-2025-34421
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local write access to install directory
-
ExploitPlant malicious MEAISP.DLL
-
ExecutionAdministrative executable loads DLL insecurely
-
ImpactAttacker code runs with process privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Requires a local attacker with filesystem write access to the MailEnable installation directory, because the MailEnable administrative executable loads MEAISP.DLL from that directory using an insecure search order with no integrity validation. Exploitation is further gated by requiring that the administrative executable actually be launched (typically by an administrator or service) after the malicious DLL is planted, and it only works on installs prior to version 10.54. The decisive limiting factor is AV:L with PR:L - there is no remote vector and no default-configuration network exposure; an attacker must already have authenticated local access and write permissions to the target directory, which should not be world-writable in a hardened deployment. |
| Impact | This is a local DLL hijacking flaw (CWE-427) in MailEnable's administrative executable that unsafely loads MEAISP.DLL from its installation directory. The provided CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) and the 8.5 score reflect high technical impact (VC:H/VI:H/VA:H) but local access with low privileges already required - this is NOT a remote network-exploitable issue despite the 'RCE' tag. The supporting signals point AWAY from urgent, widespread risk: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The scope is unchanged (SC:N/SI:N/SA:N), so impact is confined to the process context. The realistic prerequisite - a local attacker who already has write access to the install directory - means this is a privilege-escalation / code-integrity concern rather than an internet-facing emergency. Net: a genuinely high-impact but low-likelihood, locally-gated bug that warrants patching on a normal cycle, not emergency response. Note a tension worth flagging: the 'RCE' tag and 'local arbitrary code execution' phrasing can be misread as remote RCE - the authoritative CVSS vector confirms AV:L (local only). |
| Exploit ScenarioDerived | A low-privileged local user (or malware already resident on the host) with write access to the MailEnable installation directory plants a malicious MEAISP.DLL in that folder. When an administrator or a service subsequently runs the MailEnable administrative executable, the rogue DLL is loaded without integrity validation, executing attacker code with the privileges of that process. No public exploit code is referenced, and exploitation requires pre-existing local write access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory plant a malicious MEAISP.DLL that the administrative executable loads on start, yielding code execution with the process's privileges. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms this requires authenticated local access and write permission to the install path - there is no remote vector - and the victim must subsequently launch the affected executable. All builds prior to 10.54 are affected; EPSS is low at 0.20% (9th percentile) and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade MailEnable to version 10.54 or later, which is the vendor-released patch that remediates the unsafe loading of MEAISP.DLL; consult the release notes at https://mailenable.com/Standard-ReleaseNotes.txt and the VulnCheck advisory at https://www.vulncheck.com/advisories/mailenable-dll-hijacking-via-unsafe-loading-of-meaisp-dll for the corresponding change. If immediate upgrade is not possible, the decisive compensating control is filesystem hardening: tighten NTFS ACLs on the MailEnable installation directory so that only SYSTEM, Administrators, and the MailEnable service account have write or modify rights, removing any inheritance or grants to local users or the Users group - this eliminates the write primitive the exploit depends on, though it must be audited after future upgrades or reinstalls that may reset permissions. Additionally, restrict interactive logon and service-account rights so that the administrative executable is launched only by trusted operators, and monitor the install directory for unexpected or replaced DLLs (particularly MEAISP.DLL) as a detection measure. Note that these workarounds reduce risk but do not fix the underlying uncontrolled search path, so upgrade remains the primary remedy.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-427, Uncontrolled Search Path Element. MailEnable's administrative executable resolves MEAISP.DLL relative to its own installation directory without validating the file's integrity or enforcing a secure, trusted search order, so any DLL placed at that path is loaded at runtime. This is a classic DLL hijacking/preloading scenario: the vulnerable process inherits the privilege of whatever account starts it (typically an administrator or a service account), so a local adversary with write access to the MailEnable program directory converts that write primitive into arbitrary code execution in the context of that process. The CPE cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:* identifies the Standard edition as the catalogued affected product, though the unsafe-loading behavior applies to the administrative component shipped with builds before 10.54. Because abuse is gated on filesystem write access plus a subsequent privileged launch, the practical attack surface is a post-compromise privilege-escalation or persistence primitive rather than a remote entry point.
Know when Mailenable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:L and PR:L because exploitation needs local write access to the install directory; UI:N since the DLL loads automatically on execution; C/I/A:H for full code execution in the process context.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAISP.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAISP.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
Executive ViewAI
MailEnable installations prior to version 10.54 on Windows servers are exposed to a local DLL hijacking flaw that can let an authenticated local attacker execute code with the privileges of an administrative process. Because MailEnable often supports business-critical email, a compromised server could affect email confidentiality, integrity, and availability, but exploitation requires local write access to the installation directory and an administrator launching the affected executable. Leadership should prioritize limiting local write permissions and monitoring for unauthorized DLL placement while no vendor patch is available.
No vendor-released patch identified at time of analysis. Restrict NTFS write access to the MailEnable installation directory to only the minimum trusted service and administrative accounts; monitor and alert on creation or modification of MEAISP.DLL in that path; implement application allowlisting to prevent unauthorized DLL loading into MailEnable administrative executables; reduce local administrative and interactive access on the MailEnable server; and audit permissions regularly until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Mailenable
View allXSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged W
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installatio
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.D
Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative execu
Local DLL hijacking in MailEnable versions prior to 10.54 allows an attacker who can already write to the product's inst
GitHub PoC
Exploit-DB