Which versions of Mailenable are affected by CVE-2026-32851?

CVE-2026-32851 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32851?

Yes, a public proof-of-concept exploit is available for CVE-2026-32851. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-32851?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Mailenable CVE-2026-32851

Q: What is the CVSS score of CVE-2026-32851?

CVE-2026-32851 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14520 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 VulnCheck

GHSA-5fjm-c352-35cv

XSS Mailenable

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 14:30 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 19:30 euvd

EUVD-2026-14520

Analysis Generated

Mar 23, 2026 - 19:30 vuln.today

Patch released

Mar 23, 2026 - 19:30 nvd

Patch available

CVE Published

Mar 23, 2026 - 19:06 nvd

MEDIUM 5.1

DescriptionCVE.org

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the Attendees parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

AnalysisAI

MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XS) vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser without requiring authentication or special privileges. The vulnerability exists in the FreeBusy.aspx form where the Attendees parameter is not properly sanitized before being embedded into dynamically generated JavaScript, enabling attackers to craft malicious URLs that compromise user sessions and steal sensitive data. A public proof-of-concept exploit is available, increasing the practical risk to deployed MailEnable installations.

Technical ContextAI

The vulnerability is a classic reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in MailEnable's ASP.NET-based webmail interface. MailEnable is a Windows-based mail server and webmail platform (CPE: cpe:2.3:a:mailenable:mailenable:*:*:*:*:*:*:*:*) that processes user input from the Attendees parameter in the FreeBusy.aspx form without proper output encoding or input validation. The parameter value is directly concatenated into client-side JavaScript code that executes in the user's browser context, allowing attackers to break out of the intended string context and inject arbitrary JavaScript. This is a server-side rendering vulnerability where user-controlled data reaches the DOM without sanitization, creating an attack surface for session hijacking, credential theft, and malware distribution.

RemediationAI

Immediately upgrade MailEnable to version 10.55 or later, as this version contains the required input sanitization and output encoding fixes. The vendor advisory is available at https://www.mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055. If immediate patching is not feasible, implement compensating controls by deploying a Web Application Firewall (WAF) to detect and block malicious Attendees parameter payloads using signatures for common XSS patterns, enforce Content Security Policy (CSP) headers to restrict inline script execution, and restrict access to the webmail interface to trusted IP ranges or require VPN authentication. Additionally, educate users not to click on untrusted links to webmail and monitor authentication logs for signs of session compromise. Priority should remain on applying the vendor patch as soon as possible.