CVE-2025-68721: Axigen Mail Server

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section.

Affected products

• Axigen Axigen Mail Server: from 10.3.0, before 10.5.57 (fixed in 10.5.57); from 10.6.0, before 10.6.26 (fixed in 10.6.26)

Published 2026-02-05. Last modified 2026-06-17.