CVE Intelligence
Analysis AI-assisted

CVE-2026-6350: Openfind MailGates/MailAudit Stack-based Buffer Overflow

Openfind's MailGates and MailAudit contain a stack-based buffer overflow (CWE-121) that, according to the record, may let unauthenticated remote attackers influence program execution flow and run arbitrary code. TWCERT assigned a CVSS 3.1 base score of 9.8 and a CVSS 4.0 score of 9.3. The record lists no affected versions, no fixed versions and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The TWCERT advisories referenced in this record describe a stack-based buffer overflow (CWE-121) in MailGates/MailAudit developed by Openfind. The record states that an unauthenticated remote attacker may be able to control the program's execution flow and run arbitrary code.

Impact

  • The record describes arbitrary code execution with no authentication required.
  • The CNA assigned a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 9.3.
  • The CVSS 3.1 severity profile rates confidentiality, integrity and availability impact as high.

Affected products and versions

  • Product: MailGates/MailAudit developed by Openfind.
  • The record does not list affected version ranges. Consult the vendor and the TWCERT advisories to confirm which builds are affected.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS reports a probability of 0.00981 and a percentile of 0.61283 at the date given in the record.

Remediation and mitigation

  • The record contains no fixed version. Check the TWCERT advisories and Openfind communications for an update and apply it once it is confirmed.
  • Until a fix is verified, restrict network exposure of the service, limit reachable interfaces to trusted networks and place access controls in front of it.
  • Prioritize this asset because of its critical rating and the absence of an authentication requirement.

Detection guidance

  • Monitor for unexpected crashes or restarts of the MailGates/MailAudit service.
  • Review logs for unusual requests from untrusted sources reaching the service.
  • Look for unexpected child processes or outbound connections originating from the mail server.

Limitations of the available information

  • The record has no affected version list, no fixed version and no vendor advisory text.
  • The record has no English title, so the title was written from the description.
  • Details of the vulnerable component and of the exploitation path are not present in the record.

Frequently asked questions

Does this CVE require authentication to be exploited?

According to the record, the vulnerability can be reached by unauthenticated remote attackers, which is why it is rated critical. Confirm the exact preconditions with the TWCERT advisories.

Is a fixed version available?

The record does not list any fixed version. Check the TWCERT advisories and the vendor for an update before assuming a fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.