CVE-2025-68721: Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions…

PriorityP356high8.1CVSS 3.1

AVNACLPRLUINSUCHIHAN

EPSS

0.31%

22.7th percentile

Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
axigen	axigen_mail_server	>= 10.3.0 < 10.5.57	10.5.57
axigen	axigen_mail_server	>= 10.6.0 < 10.6.26	10.6.26

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.