CVE-2020-36519: Mimecast Email Security

Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days.

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.)

Affected products

• Mimecast Email Security: before 2020-01-10 (fixed in 2020-01-10)

Published 2022-03-16. Last modified 2026-06-17.