CVE-2025-68723: Axigen Mail Server WebAdmin Stored XSS
CVE-2025-68723 is a stored cross-site scripting issue in the WebAdmin interface of Axigen Mail Server, present in three places in the administration console. NVD rates it 9.0 (Critical) under CVSS 3.1, and the record lists affected ranges from 10.3.0 up to before 10.5.57 and from 10.6.0 up to before 10.6.26. No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV.
Overview
The WebAdmin interface of Axigen Mail Server contains three stored cross-site scripting (XSS) issues, classified as CWE-79. Stored XSS means the malicious script is saved by the application and then runs in the browser of any administrator who opens the affected page or feature. According to the record, the main concern is that a low-privileged administrator could use these weaknesses to target a higher-privileged administrator.
Impact
- Script execution in the browser session of an administrator who views an affected page or feature.
- Possible unauthorized actions performed under a higher-privileged administrator account, as described in the record.
- The NVD base score is 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, which indicates a network attack vector, low complexity, low privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Axigen Axigen Mail Server, with ranges listed as 10.3.0 or later and before 10.5.57, and 10.6.0 or later and before 10.6.26.
- The record's description refers to versions before 10.5.57, while the structured fixes field is empty.
- Compare your installed build against the Axigen knowledge base advisory and the Axigen download page.
Exploitation status
The record shows this CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. No EPSS data is available in the record.
Remediation and mitigation
- Inventory all Axigen installations and record their exact build numbers.
- Update to a build the vendor identifies as fixed, using the vendor advisory and download page as the authoritative references.
- Until patching is complete, restrict access to the WebAdmin interface to trusted networks and limit administrator accounts to people who need them.
- Instruct administrators not to open the affected pages from untrusted links and to log out after administrative sessions.
- Review existing log and certificate configuration entries for unexpected content.
Detection guidance
- Review WebAdmin audit or access logs for unusual changes to log file names, certificate file names or certificate content.
- Look for administrative configuration changes that the administrators on record did not initiate.
- Monitor SSL listener configuration for unexpected modifications.
Limitations of the available information
The record gives version thresholds but does not confirm exact fixed builds, does not list fixes, and provides no EPSS score. The full vendor advisory was not reviewed for this analysis, so its specific remediation details are unknown here.
Frequently asked questions
What is CVE-2025-68723?
It is a stored cross-site scripting vulnerability in the WebAdmin interface of Axigen Mail Server, tracked as CWE-79, with three affected locations in the administration console.
Which Axigen versions are listed as affected?
The record lists versions from 10.3.0 up to before 10.5.57 and from 10.6.0 up to before 10.6.26. Confirm your exact build against the vendor advisory.
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. This is not a guarantee that exploitation has not occurred.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.