CVE-2026-6351: Openfind｜MailGates/MailAudit - CRLF Injection

Published Apr 16, 2026

Updated

MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.

Affected Software

2 affected components

Openfind MailGates

Openfind MailAudit

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MailGates/MailAudit 5.0 to a version that resolves this vulnerability.
Fixed in 5.2.10.099
Upgrade
Upgrade MailGates/MailAudit 6.0 to a version that resolves this vulnerability.
Fixed in 6.1.10.054

Event History

Apr 16, 2026

CVE Published

via MITRE·02:39 AM

Data Sourced

via MITRE·02:39 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Aug 24, 58276

Event

via FIRST·04:56 PM

Frequently Asked Questions

What is the severity of CVE-2026-6351?

The severity of CVE-2026-6351 is considered critical due to its ability to allow unauthenticated remote attackers to exploit it.

How do I fix CVE-2026-6351?

To fix CVE-2026-6351, update your Openfind MailGates and MailAudit software to the latest patched version.

What does CVE-2026-6351 allow attackers to do?

CVE-2026-6351 allows attackers to perform CRLF injection, potentially enabling them to read sensitive system files.

Is CVE-2026-6351 exploitable without authentication?

Yes, CVE-2026-6351 is exploitable by unauthenticated remote attackers, increasing its risk.

Which products are affected by CVE-2026-6351?

CVE-2026-6351 affects Openfind MailGates and MailAudit software.