CVE-2026-6351

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6351", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2026-04-15T11:32:32.176Z", "datePublished": "2026-04-16T02:39:02.015Z", "dateUpdated": "2026-04-16T13:02:24.951Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-04-16T02:39:02.015Z"}, "title": "Openfind\uff5cMailGates/MailAudit - CRLF Injection", "datePublic": "2026-04-16T02:34:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-93", "description": "CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-15", "descriptions": [{"lang": "en", "value": "CAPEC-15 Command Delimiters"}]}], "affected": [{"vendor": "Openfind", "product": "MailGates", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.1.10.054", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.2.10.099", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Openfind", "product": "MailAudit", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.1.10.054", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.2.10.099", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files."}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10844-1405d-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "MailGates/MailAudit 6.0\uff1a Update to version 6.1.10.054 or later\n\nMailGates/MailAudit 5.0\uff1a Update to version 5.2.10.099 or later", "supportingMedia": [{"type": "text/html", "base64": false, "value": "MailGates/MailAudit 6.0\uff1a Update to version 6.1.10.054 or later\n<br>MailGates/MailAudit 5.0\uff1a Update to version 5.2.10.099 or later"}]}], "source": {"advisory": "TVN-202604003", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:02:17.083959Z", "id": "CVE-2026-6351", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:02:24.951Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6351", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:02:17.083959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:02:21.783Z"}}], "cna": {"title": "Openfind\uff5cMailGates/MailAudit - CRLF Injection", "source": {"advisory": "TVN-202604003", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-15", "descriptions": [{"lang": "en", "value": "CAPEC-15 Command Delimiters"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Openfind", "product": "MailGates", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.1.10.054", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.2.10.099", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Openfind", "product": "MailAudit", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.1.10.054", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.2.10.099", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "MailGates/MailAudit 6.0\uff1a Update to version 6.1.10.054 or later\n\nMailGates/MailAudit 5.0\uff1a Update to version 5.2.10.099 or later", "supportingMedia": [{"type": "text/html", "value": "MailGates/MailAudit 6.0\uff1a Update to version 6.1.10.054 or later\n<br>MailGates/MailAudit 5.0\uff1a Update to version 5.2.10.099 or later", "base64": false}]}], "datePublic": "2026-04-16T02:34:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10844-1405d-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.", "supportingMedia": [{"type": "text/html", "value": "MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-04-16T02:39:02.015Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6351", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:02:24.951Z", "dateReserved": "2026-04-15T11:32:32.176Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2026-04-16T02:39:02.015Z", "assignerShortName": "twcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MailGates", "vendor": "Openfind", "versions": [{"lessThan": "6.1.10.054", "status": "affected", "version": "6.0", "versionType": "custom"}, {"lessThan": "5.2.10.099", "status": "affected", "version": "5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "MailAudit", "vendor": "Openfind", "versions": [{"lessThan": "6.1.10.054", "status": "affected", "version": "6.0", "versionType": "custom"}, {"lessThan": "5.2.10.099", "status": "affected", "version": "5.0", "versionType": "custom"}]}], "source": "twcert@cert.org.tw"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files."}, {"lang": "es", "value": "MailGates/MailAudit desarrollado por Openfind tiene una vulnerabilidad de inyecci\u00f3n CRLF, permitiendo a atacantes remotos no autenticados explotar esta vulnerabilidad para leer archivos del sistema."}], "id": "CVE-2026-6351", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "twcert@cert.org.tw", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6351", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:02:17.083959Z", "version": "2.0.3"}}]}, "published": "2026-04-16T03:16:31.053", "references": [{"source": "twcert@cert.org.tw", "url": "https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html"}, {"source": "twcert@cert.org.tw", "url": "https://www.twcert.org.tw/tw/cp-132-10844-1405d-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.1.10.054)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0,5.2.10.099)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MailAudit", "source": "cna", "vendor": "Openfind"}, "product": "mailaudit", "vendor": "openfind"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.1.10.054)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0,5.2.10.099)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MailGates", "source": "cna", "vendor": "Openfind"}, "product": "mailgates", "vendor": "openfind"}], "analysis": {"en": {"generated_at": "2026-04-16T08:59:50.960695+00:00", "value": {"mitigation_remediation": ["Upgrade to at least 6.1.10.054 for 6.x releases or 5.2.10.099 for 5.x releases", "Apply server\u2011side input validation to reject CRLF characters in all user\u2011supplied fields that influence HTTP headers", "Restrict remote access to the application from trusted networks and monitor logs for anomalous request patterns"], "summary": {"action": "Patch", "impact": "Read system files"}, "threat_synthesis": {"affected_systems": "Affected editions of Openfind MailAudit and MailGates are versions 6.0 through 6.1.10.054 and 5.0 through 5.2.10.099; the vendor recommends upgrading to 6.1.10.054 or later on the 6.x line, or to 5.2.10.099 or later on the 5.x line.", "description_and_impact": "The flaw is a CRLF Injection vulnerability (CWE-93) in Openfind MailAudit and MailGates that allows unauthenticated remote attackers to inject carriage return and line feed characters into input, causing the server to interpret them as header delimiters and enabling the reading of arbitrary system files the server can access.", "risk_and_exploitability": "Based on the description, the attack appears to hinge on sending crafted HTTP requests that embed CRLF sequences in user input. The flaw scores 8.7 on CVSS, indicating high severity, but EPSS data is unavailable and the issue is not listed in CISA\u2019s KEV catalog. The ability to read system files can expose configuration, credentials or other privileged data, potentially allowing an attacker to elevate privileges or launch further attacks. Prompt patching is essential."}}}}, "created": "2026-04-16T04:00:09.223941+00:00", "updated": "2026-04-16T09:00:05.300394+00:00", "vendors": ["openfind", "openfind$PRODUCT$mailaudit", "openfind$PRODUCT$mailgates"]}