Which versions of MailEnable Enterprise are affected by CVE-2026-44400?

MailEnable Enterprise Premium versions 10.55 and earlier contain a privilege escalation vulnerability that allows authenticated WebMail users to obtain full administrative control of the mail server…. A patch is available.

How to fix or mitigate CVE-2026-44400?

Within 24 hours, perform a complete inventory of all MailEnable Enterprise Premium deployments running version 10.55 or earlier, including documentation of WebMail and WebAdmin internet exposure. Within 7 days, apply the available vendor patch to all identified instances, prioritizing production mail servers. Within 30 days, audit mail server authentication logs for the preceding 60 days to identify potential token replay anomalies and verify patched systems are functioning normally.

MailEnable Enterprise CVE-2026-44400

Q: What is the CVSS score of CVE-2026-44400?

CVE-2026-44400 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28827 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-08 VulnCheck

GHSA-f3v7-jqh4-whf5

Authentication Bypass Mailenable Mailenable Enterprise Premium

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable portal (AV:N), simple cookie replay (AC:L), requires a low-privilege mailbox account (PR:L), no user interaction, and full admin compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:49 vuln.today

Patch available

May 08, 2026 - 22:03 EUVD

CVSS changed

May 08, 2026 - 21:22 NVD

8.1 (HIGH) 8.7 (HIGH)

CVE Published

May 08, 2026 - 20:22 nvd

HIGH 8.7

DescriptionCVE.org

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.

AnalysisAI

Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged WebMail user gain full administrative control of the mail server. An authenticated attacker obtains an AuthenticationToken cookie from the WebMail login endpoint using the PersistentLogin parameter and replays it against the WebAdmin mobile portal, which fails to validate the token's privilege level. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and the flaw is not in CISA KEV, but the technical impact is total server compromise.

Technical ContextAI

MailEnable is a commercial Windows-based mail server (SMTP/IMAP/POP/webmail) whose web tier splits into a WebMail portal for end users and a WebAdmin portal for administrators. Authentication is carried by a shared AuthenticationToken cookie. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the WebAdmin mobile portal trusts the presence of a valid AuthenticationToken without re-checking that the associated account actually holds administrative privileges. Because the same token issuance mechanism (WebMail login with PersistentLogin) serves both portals, a token minted for a low-privileged mailbox is honored by the high-privilege portal. The affected component is identified by CPE cpe:2.3:a:mailenable:mailenable_enterprise_premium.

RemediationAI

Patch available per vendor advisory: upgrade MailEnable Enterprise Premium to the fixed build listed in the vendor release notes at https://www.mailenable.com/Premium-ReleaseNotes.txt (an exact patched version number is not stated in the available data - confirm the current release, which is later than 10.55, directly with MailEnable), and review the VulnCheck advisory at https://www.vulncheck.com/advisories/mailenable-enterprise-premium-authorization-bypass-via-webadmin for details. Until patched, restrict network access to the WebAdmin mobile portal so it is reachable only from trusted administrative networks or over VPN rather than the public internet (trade-off: remote admins lose direct access); if the mobile WebAdmin portal is not used, disable or block that endpoint at the web server or reverse proxy while leaving WebMail functional; and consider invalidating existing persistent AuthenticationToken cookies and disabling the PersistentLogin option to force fresh, privilege-appropriate sessions (trade-off: users must re-authenticate more often).