CVE-2018-7701: Securenvoy Securmail

Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a delete action in a request to secmail/getmessage.exe or (2) spoof arbitrary users and reply to their messages via a request to secserver/securectrl.exe.

Affected products

• Securenvoy Securmail: before 9.2.501 (fixed in 9.2.501)

Published 2018-03-15. Last modified 2026-06-17.