Cleartext Credential Storage in MailEnable (CVE‑2026‑114551) Enables Remote Information Disclosure
What It Is — MailEnable’s mail server stores mailbox credentials in cleartext. An unauthenticated remote attacker can query the vulnerable component and retrieve those stored passwords, potentially chaining the data to compromise additional systems. The flaw is tracked as CVE‑2026‑114551, carries a CVSS 5.9 (moderate) score, and was patched in MailEnable 10.60. No public exploitation has been reported, but the vulnerability is fully disclosed and exploitable.
Affected Products – MailEnable mail server (all versions prior to 10.60).
Why It Matters for Trust & Control Assurance – Storing authentication secrets in plaintext violates the control objective of protecting credential confidentiality, a requirement across most security frameworks.
Recommended Actions – Upgrade to MailEnable 10.60 or later, audit all stored credential repositories for cleartext data, and implement encryption or secure vaulting for authentication secrets. Source: Zero Day Initiative Advisory