CVE-2026-32851: MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MailEnableto a version that resolves this vulnerability.Fixed in 10.55 - Compensating control
If you cannot immediately upgrade MailEnable to 10.55, mitigate the reflected XSS by restricting access to the MailEnable webmail interface (e.g., via network ACL/firewall) to trusted users/sources to reduce exposure to crafted malicious URLs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32851?
CVE-2026-32851 is classified as a medium severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-32851?
To fix CVE-2026-32851, upgrade to MailEnable version 10.55 or later.
What impact does CVE-2026-32851 have on affected systems?
CVE-2026-32851 allows remote attackers to execute arbitrary JavaScript in a victim's browser through crafted URLs.
Which versions of MailEnable are affected by CVE-2026-32851?
MailEnable versions prior to 10.55 are affected by CVE-2026-32851.
Where can I find more information about CVE-2026-32851?
Information regarding CVE-2026-32851 can be found in the release notes for MailEnable and related security advisories.