XXE Information Disclosure in MailEnable (CVE‑2026‑114552) Allows Authenticated Data Exposure
What It Is — The Zero Day Initiative advisory (ZDI‑26‑811) details an XML External Entity (XXE) flaw in MailEnable’s parseObjectResponse method. An authenticated remote attacker can craft malicious XML that forces the service account to process external entities, resulting in disclosure of arbitrary files or configuration data. The vulnerability is rated CVSS 6.5 (moderate) with a “high” confidentiality impact. MailEnable released a fix in version 10.60.
Affected Products — MailEnable mail server (all versions prior to 10.60).
Why It Matters for Trust & Control Assurance — It tests the control objective of secure configuration and input validation; organizations need verifiable evidence that XML parsers are hardened to prevent data‑exposure pathways.
Recommended Actions —
- Upgrade all MailEnable installations to 10.60 or later.
- Verify that XML parser settings disallow external entity resolution.
- Conduct a configuration audit focused on input‑validation controls and document the findings for audit readiness.
- Incorporate XXE testing into regular vulnerability‑scanning pipelines.
Source: ZDI‑26‑811 advisory