Mailgates CVE-2026-6351

Exploitation requires network access to the MailGates/MailAudit web interface (typically TCP ports 80/443). No authentication required-CVSS vector confirms PR:N (no privileges needed). Vulnerability exists in default product configurations without requiring specific feature enablement. Attack complexity is low (AC:L, AT:N) with no user interaction needed (UI:N), meaning attackers can exploit directly via HTTP requests to vulnerable endpoints. Limited to reading files accessible to the application process user context; impact scope confined to the vulnerable component (SC:N). Organizations that have restricted web interface access to internal management networks only are not exploitable from the public internet.

Real-world risk is HIGH despite absence of CISA KEV listing or public exploits. CVSS 8.7 (4.0 vector) reflects maximum-severity confidentiality impact (VC:H) with network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N), creating a wide attack surface. The specific impact-unauthorized system file reads-enables credential theft, configuration disclosure, and reconnaissance for further attacks against email security infrastructure. EPSS and SSVC data not provided, but the combination of unauthenticated remote exploitation and file disclosure constitutes a priority remediation event for organizations running these email security appliances. Taiwan CERT disclosure suggests active regional awareness; exploitation may emerge as vendor advisories circulate. Enterprise email systems are high-value targets, and CRLF injection primitives are well-understood by attackers. The lack of public exploit code provides a brief remediation window before widespread scanning begins.

Attacker crafts HTTP request to MailGates web interface containing CRLF sequences (e.g., %0D%0A) in a vulnerable parameter, injecting malicious headers into the server's HTTP response. By manipulating response structure, the attacker forces the application to read and reflect contents of sensitive system files (such as /etc/passwd, configuration files containing database credentials, or SSL private keys) in the HTTP response body, which the attacker receives and exfiltrates. No authentication required; exploitation is fully remote.