MailEnable Suffers Information Disclosure Vulnerability via XXE

Zero Day Initiative (ZDI) has disclosed a critical XML External Entity (XXE) processing vulnerability, identified as ZDI-26-811 and CVE-2026-114552, affecting MailEnable software. This flaw allows remote attackers with prior authentication to potentially access sensitive information residing on vulnerable installations.

The vulnerability stems from an insufficient restriction of XML External Entity references within the parseObjectResponse method of the MailEnable application. By crafting malicious XML input, an attacker can exploit this weakness to read arbitrary files or disclose information that the service account has access to, thereby compromising data confidentiality.

With a CVSS score of 6.5, this vulnerability is rated as medium-high severity. While it requires authentication, the ability to disclose sensitive information makes it a significant concern for organizations using MailEnable. The disclosure timeline indicates that the vulnerability was reported to the vendor on September 18, 2026, and a coordinated public release of the advisory occurred on October 27, 2026, with an update to the advisory on the same day.

MailEnable has addressed this vulnerability by releasing version 10.60. Users are strongly advised to update to this latest version to mitigate the risk of exploitation. Further details on the fixes can be found in the premium release notes available on the MailEnable website.

This XXE vulnerability highlights a persistent class of security flaws that arise from the improper handling of XML parsing. Many applications, especially older ones or those with complex XML processing requirements, can be susceptible if input validation and entity resolution are not meticulously managed. The impact can range from denial-of-service to sensitive data exfiltration, depending on the context and privileges of the affected service.

The disclosure by Zero Day Initiative, a well-known broker of zero-day vulnerabilities, underscores the importance of proactive security testing and timely patching. The fact that this vulnerability requires authentication means that attackers would first need to compromise legitimate user credentials or exploit another vulnerability to gain initial access before leveraging the XXE flaw.

Organizations utilizing MailEnable should prioritize updating their systems to version 10.60. In parallel, security teams should review their network perimeters and internal access controls to ensure that only authorized personnel can access MailEnable services, and that any suspicious authentication attempts are flagged and investigated.

This advisory serves as a reminder for developers and security professionals to remain vigilant against common vulnerability types like XXE. Proper input sanitization, disabling external entity processing by default, and employing robust security configurations are crucial steps in preventing such information disclosure incidents.

The Zero Day Initiative has released details on a new information disclosure vulnerability affecting MailEnable servers, identified as ZDI-26-810. This flaw, assigned CVE-2026-114551, differs from the previously reported XXE vulnerability (CVE-2026-114552) as it stems from the plaintext storage of mailbox credentials. While the CVSS score of 5.9 indicates a moderate severity, it allows unauthenticated remote attackers to access sensitive information, potentially leading to further system compromise.