MailEnable
CVE-2025-34424
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local write access to install directory
-
ExploitPlant malicious MEAIDP.DLL
-
ExecutionAdmin executable loads DLL insecurely
-
ImpactAttacker code runs at process privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires a local attacker to already hold write access to the MailEnable installation directory so that a malicious MEAIDP.DLL can be planted, and requires the MailEnable administrative executable to subsequently be executed so the planted DLL is loaded via the insecure search order. Limiting factors: this is local-only (no network vector), the installation directory is often under Program Files where write access is restricted to privileged accounts by default, and the payload only runs at the privilege level of whichever account launches the admin executable. Affected: MailEnable versions prior to 10.54. |
| Impact | This is a high-CVSS but comparatively low-real-world-urgency issue when all signals are weighed together. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5) correctly reflects a LOCAL attack vector requiring low privileges - this is not a remotely exploitable flaw despite the 'RCE' tag. EPSS is only 0.17% (6th percentile), consistent with the local-only nature and the fact that exploitation first requires an attacker to already have write access to the MailEnable installation directory. There is no CISA KEV listing and no public exploit code identified at time of analysis - only a VulnCheck advisory describing the issue. The signals are mutually consistent rather than conflicting: a genuine integrity/availability risk (CWE-427 DLL hijacking) that is gated behind a meaningful local prerequisite. Treat this as a defense-in-depth / local privilege-escalation hardening item rather than an emergency internet-facing patch. Note: the 'RCE' tag implies remote code execution, but the description explicitly states LOCAL arbitrary code execution - this should be read as local, not network-triggerable. |
| Exploit ScenarioDerived | A local user (or a low-privileged process) that can write to the MailEnable installation directory drops a malicious MEAIDP.DLL into that folder. When the MailEnable administrative executable is next launched, it loads the planted DLL via an insecure search order, executing the attacker's code with the privileges of that process - typically yielding privilege escalation. No public exploit code is identified at time of analysis, though the technique (classic DLL search-order hijacking) is well understood and trivial to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local arbitrary code execution in MailEnable versions prior to 10.54 is possible because the MailEnable administrative executable loads MEAIDP.DLL from its installation directory using an insecure search order and without validating the file's integrity. An attacker who already holds write access to that directory (CVSS vector PR:L, AV:L - a locally authenticated low-privileged user) can drop a malicious MEAIDP.DLL that is loaded the next time the admin tool runs, executing code at the privilege level of the launching account. The flaw is fixed in 10.54; there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is just 0.17% (6th percentile), so real-world urgency is comparatively low despite the 8.5 vendor score.
RemediationAI
Upgrade to MailEnable 10.54 or later - the vendor release notes (https://mailenable.com/Standard-ReleaseNotes.txt) document the build that removes the insecure load path for MEAIDP.DLL; this is the only complete fix and should be applied to every MailEnable server, not just the management host. Until the upgrade is deployed, apply these compensating controls and accept their trade-offs: tighten the NTFS ACLs on the MailEnable installation directory so that only Administrators, SYSTEM, and the MailEnable service account have write/modify rights, removing Users, Authenticated Users, and Everyone write permissions (side effect: delegated admins and any custom scripts that write logs, config, or plugins under that path will break and must be re-permissioned); if a narrower scope is needed, grant read+execute to the service account but keep write access off for everyone else. Where operationally feasible, run the MailEnable administrative executable only under an account that has no reason to be tricked into loading a user-writable DLL and audit for unexpected or unsigned MEAIDP.dll files appearing in the install directory (an unsigned or recently created MEAIDP.dll is a strong indicator of attempted hijacking). Note that restricting directory permissions is a mitigation, not a substitute for patching, since any regression in ACLs re-exposes the host.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic uncontrolled search path / DLL hijacking issue (CWE-427). The MailEnable administrative executable resolves the MEAIDP.DLL dependency by searching its own installation directory before trusted, system-protected locations such as System32, and it does not verify a signature, hash, or path allowlist for the resolved module. Because MEAIDP.DLL is expected to live alongside the executable and that directory is writable by the local user or group that installed/administers MailEnable, an attacker who can create or overwrite files there can substitute their own library. Windows resolves the import at process start, so the planted DLL's DllMain and exported entry points run inside the admin process, inheriting its token and integrity level. The CPE cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:* identifies the affected edition family - MailEnable Standard builds below 10.54 - and the vulnerable component is the administrative/management executable rather than the SMTP/POP3/IMAP service stack, which is why the attack is strictly local rather than network-reachable.
Know when Mailenable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL-planting requires existing write access to the install directory so AV:L and PR:L; low complexity and full code execution yield C/I/A:H with no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAIDP.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAIDP.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
Executive ViewAI
Organizations running MailEnable versions prior to 10.54 on Windows servers are exposed to a local privilege-escalation flaw in the administrative executable, where a low-privileged authenticated user with write access to the installation directory can execute code at the launching account's privilege level. This could lead to full compromise of the mail server, including email data, credentials, and business communications, though exploitation requires local access and no public exploit identified at time of analysis. Leadership should prioritize patching to 10.54 and tightening directory permissions to reduce insider or lateral-movement risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Mailenable
View allXSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged W
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installatio
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.D
Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative execu
GitHub PoC
Exploit-DB