Axigen Mail Server EUVD-2026-114239

Exploitation requires network reachability to one of the Axigen WebMail, WebAdmin, or WebMail Proxy listeners; the attacker sends a single HTTP request carrying a SOAP/XML or JSON body nested to an extreme depth, and the parsing occurs before authentication so no credentials or user interaction are needed against a default configuration of affected versions (before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2). The main limiting factor is exposure: the relevant web listeners must be reachable from the attacker's position (internet-facing instances are fully exposed, while instances where these listeners are firewalled or restricted to trusted networks sharply reduce reach). Impact is availability-only - the server crashes and SMTP/IMAP/POP3/web services go down - with no data disclosure or modification.

This is a genuine prioritize-this-week issue for anyone running an exposed Axigen instance, though it is not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with no user interaction, which is the worst-case precondition profile; however, impact is confined entirely to availability (VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) - there is no confidentiality or integrity exposure, so this cannot be used to read mail, steal credentials, or execute code. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with a serious-but-non-catastrophic DoS. No EPSS score was provided, the CVE is not listed in CISA KEV, and no exploit/PoC reference is present in the input, so there is no public exploit identified at time of analysis; the only exploitation signal is that it was reported by VulnCheck. The signals are internally consistent (high-availability-only impact, unauthenticated network reach, moderate priority label) with no contradictions between the CVSS vector and the description. The practical driver of risk is that the affected listeners (WebMail, WebAdmin, WebMail Proxy) are frequently internet-facing, and a single crafted request crashes not just the web service but also SMTP, IMAP, and POP3 - taking the entire mail server offline repeatedly.

An attacker who can reach an Axigen WebMail, WebAdmin, or WebMail Proxy listener sends a single HTTP request whose SOAP/XML or JSON body is nested to an extreme depth, triggering uncontrolled recursion during pre-authentication parsing that exhausts the stack. The crash cascades beyond the web front end to the SMTP, IMAP, and POP3 services, and the request can be replayed to keep the server down. No authentication or user interaction is required, and no public exploit code is identified at time of analysis.