Live › vulnerability › CVE-2026-114551
MailEnable stores mailbox credentials in plaintext on affected installations. A remote attacker without an account can disclose those stored credentials, and can combine this with other flaws to take further control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Organizations running MailEnable mail server installations that store mailbox credentials. The sources do not give the affected versions or the exact configuration that exposes the stored credentials, so the exposure of any given install cannot be confirmed from them.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478.
This page as .md · .json · in your agent: get_signal("CVE-2026-114551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.