CVE-2025-68723

CRITICAL EPSS 17.4%
Published Feb 5, 20264mo ago · Modified Jun 17, 20262w ago
9.0 CVSS 3.1
Critical
Find Similar
Published Feb 5, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parameter in the Local Services Log page, (2) certificate file content in the SSL Certificates View Usage feature, and (3) the Certificate File name parameter in the WebMail Listeners SSL settings. Attackers can inject malicious JavaScript payloads that execute in administrators' browsers when they access affected pages or features, enabling privilege escalation attacks where low-privileged admins can force high-privileged admins to perform unauthorized actions.

CVSS Details

Base Score
9.0
Exploitability
2.3
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
17.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
axigenaxigen_mail_server*≥10.3.0  –  <10.5.57
axigenaxigen_mail_server*≥10.6.0  –  <10.6.26

References 3

  • github.com https://github.com/osmancanvural/CVE-2025-68723
  • axigen.com https://www.axigen.com/knowledgebase/Axigen-WebAdmin-Stored-XSS-Vulnerabilities-CVE-2025-68723-_408.html
    Vendor Advisory
  • axigen.com https://www.axigen.com/mail-server/download/
    Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.