CVE-2025-34489: Gfi Mailessentials

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.

Affected products

• Gfi Mailessentials: before 21.8 (fixed in 21.8)

Published 2025-04-28. Last modified 2026-06-17.