Axigen Mail Server EUVD-2026-114238

The attacker must be able to deliver an email to a target Axigen WebMail user with HTML and script embedded in the From display name; no attacker authentication is required (PR:N). Exploitation then requires victim interaction (UI:P): the recipient must open the folder/conversation view, at which point the unescaped display name executes. It is limited to Axigen Mail Server WebMail versions before 10.6.39 and before 10.7.1 - patched builds escape the display name - and impact is confined to the victim's authenticated webmail session (mailbox theft or redirection), not the server itself.

This is a mid-severity stored XSS (CVSS 4.0 base 5.3, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P) whose practical risk sits below its network-reachable profile. The attack vector is network and requires no attacker privileges (PR:N), meaning any outsider who can send email to a target can plant the payload - but execution hinges on victim interaction (UI:P): the recipient must open the folder/conversation view in Axigen WebMail. Impact is confined to the subsequent system (the victim's authenticated webmail session): VC/VI/VA are N while SC:L/SI:L capture limited confidentiality and integrity impact (mailbox content theft, redirection), with no availability impact. No EPSS score is provided in the input, and the CVE is NOT listed in CISA KEV, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month' - a routine-patch priority, not act_now or emergency. Reported by VulnCheck, which has published an advisory reference, but the input does not mark a confirmed working PoC. Net: a legitimate issue worth patching on a normal cadence rather than a drop-everything emergency; the combination of unauthenticated injection but mandatory user interaction and session-only impact keeps real-world risk moderate.

An attacker sends the victim an ordinary-looking email in which the From display name contains HTML and script. When the recipient opens the mailbox folder in Axigen WebMail, the unescaped display name renders in the conversation view and the script executes in the victim's authenticated session, allowing theft of mailbox contents or redirection. Execution requires the victim to view the folder (UI:P); the input marks no confirmed working exploit code, only a VulnCheck advisory reference.