CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

High 8.7 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119762?

CVE-2026-119762 is a high-severity vulnerability in Axigen Mail Server, published on 30 Oct 2026.

Official description

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

Weakness: CWE-674

Which versions are affected by CVE-2026-119762?

How do I fix CVE-2026-119762?

No fix has been published for CVE-2026-119762 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119762 being exploited?

There is no known exploitation of CVE-2026-119762 in the wild and no public exploit code.

Sources

Also known as GHSA-r369-45gr-q63m.