CVE-2025-44148: MailEnable failure.aspx XSS allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and a public exploit reference make this a high-urgency issue despite the thin description.

What it is

MailEnable before v10 contains a cross-site scripting flaw in the failure.aspx component. The record describes it as allowing a remote attacker to execute arbitrary code, and the CVSS vector rates it critical with no privileges or user interaction required. The description is thin and does not explain the exact mechanism by which XSS leads to code execution.

Impact

An unauthenticated remote attacker could execute arbitrary code in the context of the affected component. The record does not specify whether this is server-side or client-side execution, so the precise scope of compromise is unclear.

Attack surface

Reachable over the network via the failure.aspx component, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not detail the exact request or input that triggers the flaw.

Exploitation

A public exploit reference exists on GitHub, and EPSS is 0.54711 (98.972 percentile), indicating a high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so confirmed in-the-wild exploitation is not documented in this record.

What to do

• Upgrade MailEnable to v10 or later, which the record states resolves the flaw.
• If immediate upgrade is not possible, restrict network access to failure.aspx and the MailEnable web interface to trusted sources.
• Apply input validation and output encoding on the failure.aspx component as a compensating control.
• Monitor vendor advisories for a confirmed fixed build and any backports for older versions.

Detection

• Inspect web server and MailEnable logs for anomalous requests to failure.aspx containing script tags or encoded payloads.
• Alert on unexpected process creation or outbound connections originating from the MailEnable web service.
• Review GitHub exploit code for the CVE to build targeted request signatures for IDS/WAF rules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.