mail server vulnerabilities and fixes

Recent CVEs affecting mail server, with upgrade or downgrade steps. 18 tracked.

Also searched as: mailserver.

mail server has 18 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-12-04. Highest priority: CVE-2023-39699 (score 62/100).

• CVE-2025-2848 MEDIUM 6.3 UPGRADE A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive
• CVE-2021-36580 MEDIUM 6.1 UPGRADE UPGRADE Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via
• CVE-2025-40632 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0
• CVE-2025-40631 MEDIUM 6.1 DOWNGRADE HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0
• CVE-2025-40630 MEDIUM 6.1 DOWNGRADE Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0
• CVE-2023-39700 MEDIUM 6.1 DOWNGRADE IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via
• CVE-2023-39699 CRITICAL 9.8 DOWNGRADE IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the compo
• CVE-2020-23824 HIGH 8.8 DOWNGRADE ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary co
• CVE-2020-14066 HIGH 8.8 DOWNGRADE IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for client
• CVE-2020-14065 MEDIUM 6.5 DOWNGRADE IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
• CVE-2020-14064 MEDIUM 6.5 DOWNGRADE IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
• CVE-2019-19266 MEDIUM 5.4 UPGRADE IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 o
• CVE-2019-19265 MEDIUM 6.1 UPGRADE IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 o
• CVE-2019-12593 HIGH 7.5 UPGRADE IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minim
• CVE-2018-7475 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote a
• CVE-2018-16324 MEDIUM 6.1 UPGRADE In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
• CVE-2017-12844 MEDIUM 4.8 DOWNGRADE Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authen
• CVE-2015-1503 HIGH 7.5 UPGRADE Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read

FAQ

How do I fix mail server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mail server being exploited right now?

None of the tracked mail server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mail server CVE should I patch first?

CVE-2023-39699 currently ranks highest (62/100): IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the compo.

RSS feed for mail server · ← Back to latest CVEs