CVE-2025-34491: Gfi Mailessentials

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup.

Affected products

• Gfi Mailessentials: before 21.8 (fixed in 21.8)

Published 2025-04-28. Last modified 2026-06-17.