CVE-2026-32850: MailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the SelectedIndex parameter in the ManageShares.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MailEnable webmailto a version that resolves this vulnerability.Fixed in 10.55
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32850?
CVE-2026-32850 is classified as a medium severity reflected cross-site scripting vulnerability.
How do I fix CVE-2026-32850?
To mitigate CVE-2026-32850, upgrade your MailEnable installation to version 10.55 or later.
What does CVE-2026-32850 affect?
CVE-2026-32850 affects MailEnable versions prior to 10.55, specifically through the ManageShares.aspx SelectedIndex parameter.
What type of vulnerability is CVE-2026-32850?
CVE-2026-32850 is a reflected cross-site scripting (XSS) vulnerability that allows execution of arbitrary JavaScript.
Can CVE-2026-32850 be exploited remotely?
Yes, CVE-2026-32850 can be exploited remotely by attackers to execute malicious code in a victim's browser.