Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119761Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Medium 6.1

In plain English

A medium-severity cross-site scripting in Axigen Mail Server from Axigen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 75.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

Affected products (as reported)

Vendor	Product	Versions
Axigen	Axigen Mail Server	10.5.0 – before 10.6.3910.7.0 – before 10.7.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://www.axigen.com/kb/show/411 vendor-advisory
https://www.axigen.com/updates/axigen-10.6.39 release-notes
https://www.axigen.com/updates/axigen-10.7.1 release-notes
VulnCheck Advisory: Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name third-party-advisory