CVE-2026-119762
Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
| CWE | CWE-674 |
| Vendor | axigen |
| Product | axigen mail server |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for axigen axigen mail server
Be the first to know when new high vulnerabilities affecting axigen axigen mail server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Axigen / Axigen Mail Server
10.0.0 < 10.5.69 10.6.0 < 10.6.40 10.7.0 < 10.7.2
References
axigen.com: https://www.axigen.com/kb/show/412 axigen.com: https://www.axigen.com/updates/axigen-10.6.40 axigen.com: https://www.axigen.com/updates/axigen-10.7.2 vulncheck.com: https://www.vulncheck.com/advisories/axigen-mail-server-before-10.5.69-10.6.40-and-10.7.2-unauthenticated-dos-via-nested-requests
Credits
Dmitri Kaslov & rootkiTED Cristian Draghici and Gabriel Cotruta of Axigen Security Team