CVE-2026-32852: MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MailEnableto a version that resolves this vulnerability.Fixed in 10.55 - Compensating control
Block or restrict access to the MailEnable webmail interface (including FreeBusy.aspx) at the network layer (e.g., firewall/ACL) to reduce exposure to reflected XSS payloads delivered via crafted URLs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32852?
CVE-2026-32852 is classified as a reflected cross-site scripting vulnerability with a high severity allowing remote code execution.
How do I fix CVE-2026-32852?
To fix CVE-2026-32852, upgrade MailEnable to version 10.55 or later to eliminate the vulnerability.
Who is affected by CVE-2026-32852?
MailEnable versions prior to 10.55 are vulnerable to CVE-2026-32852, affecting users of the webmail interface.
What type of vulnerability is CVE-2026-32852?
CVE-2026-32852 is a reflected cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript.
Can CVE-2026-32852 be exploited remotely?
Yes, CVE-2026-32852 can be exploited remotely by attackers through crafted malicious URLs.