CVE-2025-34491: GFI MailEssentials < 21.8 MultiNode Insecure Deserialization
Published Apr 28, 2025
·Updated
GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup.
Affected Software
2 affected components
GFI MailEssentials<21.8
GFI MailEssentials<21.8
Event History
Apr 28, 2025
CVE Published
via MITRE·07:20 PM
Data Sourced
via MITRE·07:20 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-34491?
CVE-2025-34491 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2025-34491?
To fix CVE-2025-34491, upgrade GFI MailEssentials to version 21.8 or later.
3
Who is affected by CVE-2025-34491?
CVE-2025-34491 affects users of GFI MailEssentials prior to version 21.8.
4
What types of attacks can exploit CVE-2025-34491?
CVE-2025-34491 can be exploited by an authenticated remote attacker using crafted serialized .NET data.
5
What vulnerability category does CVE-2025-34491 fall under?
CVE-2025-34491 falls under the category of .NET deserialization vulnerabilities.