MailEnable
CVE-2025-34427
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local authenticated access to mail host
-
DeliveryRead cleartext AUTH.TAB credential store
-
ExploitRecover user and super-admin passwords
-
ExecutionAuthenticate to POP3/SMTP/webmail
-
ImpactFull mailbox access and admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encrypted storage of sensitive data
|
| Exploitation Conditions | Requires a local, authenticated user (or attacker-controlled process) on the Windows host running MailEnable who has filesystem READ access to the AUTH.TAB file; the vulnerability is enabled by overly permissive default NTFS permissions on that file. Exploitation is strictly local - there is no remote or network vector to the flaw itself (the recovered credentials are only then usable against POP3/SMTP/webmail). Limiting factors: attacker must already possess some level of local access to the server, and environments that have tightened AUTH.TAB file ACLs or upgraded to 10.54+ are not exposed. |
| Impact | Signals are consistent and point to a real-but-not-urgent issue. The CVSS 4.0 vector (AV:L, AC:L, PR:L, UI:N, VC:H/VI:H) correctly frames this as a locally-exploitable, low-privilege flaw with high confidentiality and integrity impact, matching the description of a local authenticated user reading AUTH.TAB. The 8.4 score is driven by the high impact (full credential and super-admin recovery), not by remote reachability - exploitation requires existing local access, which materially lowers real-world risk versus a network-facing bug. EPSS is very low (0.12%, 2nd percentile) and the CVE is NOT in CISA KEV, with no public exploit referenced, so there is no evidence of active or widespread exploitation. The low EPSS is consistent with the local-only attack vector rather than contradicting the severity. Net: prioritize for hardening on systems where untrusted or multi-user local access to the mail server host exists, but this is not a drop-everything internet-facing emergency. |
| Exploit ScenarioDerived | A low-privileged user (or an attacker who has gained a foothold on the MailEnable Windows host) reads the AUTH.TAB file, which stores all user and super-admin passwords in cleartext under overly permissive filesystem ACLs. Using the recovered super-admin and user credentials, the attacker authenticates to POP3, SMTP, or the webmail interface to access arbitrary mailboxes and seize administrative control. No public exploit code is referenced; the attack requires no tooling beyond file read access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Cleartext storage of account credentials in MailEnable versions prior to 10.54 lets any local, authenticated user who can read the AUTH.TAB file recover every mailbox password and the super-admin credentials in plaintext, then reuse them against POP3, SMTP, or webmail for full mailbox access and administrative control. The flaw is strictly local - there is no network vector to the credential exposure itself, and exploitation depends on overly permissive default NTFS permissions on AUTH.TAB, so environments with hardened file ACLs or hosts already upgraded to 10.54+ are not exposed. No public exploit code has been identified at time of analysis and MailEnable is not listed in CISA KEV; EPSS is very low at 0.12% (2nd percentile), reflecting the requirement for pre-existing local read access rather than mass remote exploitation.
RemediationAI
Upgrade to MailEnable 10.54 or later (Vendor-released patch: MailEnable 10.54, per the Standard release notes at https://mailenable.com/Standard-ReleaseNotes.txt), and rotate every mailbox and administrative password afterward, since credentials that sat in plaintext should be assumed recoverable even if the ACL was tight. If immediate upgrade is not possible, the effective compensating control is to restrict filesystem access to AUTH.TAB: remove inherited permissions and grant read access only to the MailEnable service account and local administrators, with the trade-off that misapplying the ACL will break mail services or prevent administrators from managing accounts, so test the permission set on the live service account before rollout. Consider replacing AUTH.TAB-based authentication with an integration such as Active Directory authentication so passwords are no longer stored locally at all, noting this requires configuration changes and may affect legacy POP3/IMAP clients. Monitor for unexpected reads of the MailEnable configuration directory and treat any local user account on the mail server as a potential credential-theft vector until both the upgrade and ACL hardening are complete; additional detail is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/mailenable-cleartext-credential-storage-in-auth-tab.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-312 (Cleartext Storage of Sensitive Information): MailEnable persists user and administrative passwords unencrypted inside its AUTH.TAB configuration file rather than storing salted hashes or delegating to an external identity provider. Because the file necessarily remains readable by the MailEnable service processes, its effective security boundary is entirely the Windows NTFS ACL - and the advisory states those permissions are overly permissive by default, so any principal with local read access to the configuration directory inherits the full credential set. The CPE cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:* pins the affected range to MailEnable Standard editions before 10.54, indicating the storage format was revised in that release; other MailEnable editions sharing the same AUTH.TAB mechanism should be treated as suspect unless the vendor states otherwise. The published CVSS 4.0 vector (AV:L/PR:L, VC:H/VI:H, VA:N) matches our independent CVSS 3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): the attacker must already hold a local foothold and low-privileged authenticated access, but the confidentiality and integrity impact is high because recovered super-admin credentials translate directly into control of mail services and mailboxes. There is no availability impact in either scoring.
Know when Mailenable gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Local file read by a low-privileged authenticated user (AV:L, PR:L, AC:L); full credential disclosure gives C:H and resulting admin takeover gives I:H, with no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.
Executive ViewAI
MailEnable installations running versions prior to 10.54 store all mailbox passwords and the super-admin credential in cleartext in the AUTH.TAB file, so any local user who can read that file gains full access to every mailbox and to administrative control of the mail platform. This creates organizational exposure to business email compromise, credential reuse across POP3, SMTP, and webmail, and lateral movement into other systems, with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis. Leadership should prioritize hardening file permissions and credential rotation immediately, because the flaw is confined to hosts with overly permissive local access but the resulting compromise would be broad.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting NTFS permissions on AUTH.TAB to administrative accounts only, enforcing least-privilege local logon and file read rights on MailEnable servers, rotating all mailbox and super-admin credentials, enabling file access auditing and alerting on AUTH.TAB reads, and upgrading to MailEnable 10.54 or later once vendor-confirmed as available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Mailenable
View allXSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploite
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface
MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. Rated high sever
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged W
Local DLL hijacking in MailEnable (mail server for Windows) lets an attacker who can write to the installation directory
DLL hijacking in MailEnable Standard versions prior to 10.54 allows local attackers with write access to the installatio
Local arbitrary code execution in MailEnable versions prior to 10.54, where the administrative executable loads MEAIAM.D
Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative execu
GitHub PoC
Exploit-DB