October CVE-2026-24907

The CVSS v4.0 score of 5.1 reflects a low-to-moderate vulnerability: network-accessible, low attack complexity, and no special privileges required to trigger user interaction-but critically, it requires prior authentication (PR:L) and user interaction (UI:P). The attack vector is non-adjacent network (AV:N), making it remotely exploitable. Impact is limited to low confidentiality and integrity loss; no availability or system scope changes. EPSS score and KEV status are not provided, so exploitation likelihood must be inferred from the data: this is a stored XSS requiring both authenticated access and social engineering (viewing a malicious log entry), which typically results in moderate real-world risk among multi-user systems but lower urgency than unauthenticated remote code execution. The workaround recommendations (restricting mail template editing and Event Log access) indicate the vendor recognizes this as a privileged-user attack surface, reducing enterprise risk for organizations with strong access controls. The patched versions (3.7.14 and 4.1.10) are available, making this a routine remediation priority rather than a critical emergency.

An authenticated attacker with mail template editing privileges crafts a malicious HTML email template containing embedded JavaScript (e.g., stealing session cookies or CSRF tokens). When an administrator or other authorized user views the logged mail message in the Event Log, the iframe renders the HTML without sandbox restrictions, and the JavaScript executes in the viewer's browser context with the same privileges, potentially capturing credentials or performing actions on behalf of the victim.