Which versions of Mailenable are affected by CVE-2026-32852?

CVE-2026-32852 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32852?

Yes, a public proof-of-concept exploit is available for CVE-2026-32852. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-32852?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Mailenable CVE-2026-32852

Q: What is the CVSS score of CVE-2026-32852?

CVE-2026-32852 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14521 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 VulnCheck

GHSA-cwm4-pqjw-r7wj

XSS Mailenable

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 14:29 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 19:30 euvd

EUVD-2026-14521

Analysis Generated

Mar 23, 2026 - 19:30 vuln.today

Patch released

Mar 23, 2026 - 19:30 nvd

Patch available

CVE Published

Mar 23, 2026 - 19:06 nvd

MEDIUM 5.1

DescriptionCVE.org

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

AnalysisAI

MailEnable versions prior to 10.55 contain a reflected cross-site scripting (XSS) vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser without requiring authentication or special privileges. The vulnerability exists in the FreeBusy.aspx form where the StartDate parameter is not properly sanitized before being embedded into dynamically generated JavaScript, enabling attackers to inject malicious code through a crafted URL. A public proof-of-concept exploit is available, and a patch has been released by the vendor, making this a moderate-to-high priority issue for organizations running affected versions.

Technical ContextAI

This vulnerability is rooted in improper input validation and output encoding, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is MailEnable (cpe:2.3:a:mailenable:mailenable:*:*:*:*:*:*:*:*), a mail server software that provides webmail functionality through an ASP.NET-based interface. The FreeBusy.aspx form is part of the webmail component and dynamically constructs JavaScript code by directly concatenating user-supplied input (the StartDate parameter) without proper HTML or JavaScript entity encoding. This allows an attacker to break out of the intended context and inject arbitrary JavaScript that executes in the browser of any user who clicks a malicious link, resulting in reflected XSS that can steal session cookies, credentials, or perform actions on behalf of the victim within the webmail application.

RemediationAI

Upgrade MailEnable to version 10.55 or later immediately to patch the XSS vulnerability (see vendor advisory at https://www.mailenable.com/rss/article.asp?Source=RSSADMIN&ID=MAILENABLEVERSION1055). For organizations unable to patch immediately, implement network-level controls such as restricting webmail access to trusted IP ranges, enforcing HTTPS with HSTS headers via a reverse proxy, and disabling the FreeBusy feature if not in use. Additionally, monitor web server logs for suspicious FreeBusy.aspx requests containing URL-encoded JavaScript payloads or script tags in the StartDate parameter. After patching, clear all active user sessions to invalidate any compromised session tokens.