CVE-2025-68722: axigen mail server

csirt@kutim:~/threat-intel/cve/CVE-2025-68722

CVSS 8.8 · High EPSS 0,28%

Kerentanan Cross-Site Request Forgery (CSRF) pada axigen mail server. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s (breadcrumb) parameter. The application accepts state-changing requests via the GET method and automatically processes base64-encoded commands queued in the _s parameter immediately after administrator authentication. Attackers can craft malicious URLs that, when clicked by administrators, execute arbitrary administrative actions upon login without further user interaction, including creating rogue administrator accounts or modifying critical server configurations.

Rincian

Terbit di NVD: 5 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-352: Cross-Site Request Forgery (CSRF)
EPSS (30 hari): 0,28% peluang dieksploitasi; lebih tinggi dari 18,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
axigen	axigen mail server	Versi 10.3.0 hingga sebelum 10.5.57
axigen	axigen mail server	Versi 10.6.0 hingga sebelum 10.6.26

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.axigen.com/knowledgebase/Axigen-WebAdmin-CSRF-Vulnerability-CVE-2025-68722-_407.html advisory vendor
https://github.com/osmancanvural/CVE-2025-68722 exploit · advisory vendor
https://www.axigen.com/mail-server/download/ product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.