Loading story…
Public advisories disclosed two critical pre-authentication remote code execution vulnerabilities in Xeams 10.3 build 6449 from Synametrics Technologies, both of which can reportedly deliver uid=0(root) on default deployments. One attack chain abuses the SMTP rules engine’s X-SM_SAVE_BODY_4DEBUGGING debug write behavior to place attacker-controlled files at arbitrary paths; when Xeams runs as root, the write primitive can be leveraged through cron to achieve unauthenticated root command execution.
A second flaw leaves SQLRunner.jsp exposed without authentication and combines that access with hardcoded Apache Derby credentials to let attackers run arbitrary SQL and write a JSP webshell to the server. The published reports said both exploit paths were verified end to end, giving attackers full control of the mail server and potential access to the Xeams mail repository, sharply increasing the risk of mailbox compromise, persistence, and broader server takeover.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A Full Disclosure post publicly circulated the advisory covering the two Xeams 10.3 build 6449 pre-authentication root RCE vulnerabilities. The repost highlighted that both attack chains had been verified end-to-end and could yield uid=0(root) in default deployments.
0day Rubbish Research Team publicly disclosed two critical vulnerabilities affecting Xeams 10.3 build 6449 from Synametrics Technologies. The advisories described one SMTP-based arbitrary file write to cron root RCE chain and one unauthenticated SQLRunner.jsp to Derby-backed JSP webshell root RCE chain, with proof-of-concept code and full analysis published.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open source0day-rubbish.com
Open source0day-rubbish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in mail server software that allow **unauthenticated remote code execution** through crafted SMTP input. `CVE-2019-25646` affects **Tabs Mail Carrier 2.5.1**, where an oversized `MAIL FROM` parameter triggers a **buffer overflow** on the SMTP service listening on port 25. The flaw can overwrite the `EIP` register and enable execution of attacker-controlled payloads, including a bind shell, giving remote attackers a direct path to code execution. A second flaw, `CVE-2025-71275`, affects **Zimbra Collaboration Suite 8.8.15** in the **PostJournal** service. In that case, improper sanitization of the SMTP `RCPT TO` parameter allows **command injection** via shell expansion syntax, leading to arbitrary command execution under the Zimbra service account. Both issues were classified with high impact across confidentiality, integrity, and availability, underscoring the risk posed by exposed SMTP services that process untrusted sender and recipient fields without adequate bounds checking or input sanitization.
Jun 29, 2026
Multiple flaws in the Exim mail transfer agent include **CVE-2023-42115**, a critical unauthenticated remote-code-execution vulnerability rated CVSS 9.8. The out-of-bounds write affects Exim's SMTP service when the `EXTERNAL` authentication scheme is configured and available, potentially enabling an unauthenticated remote attacker to execute code as the Exim service account. Exim versions **4.96.1** and **4.97** address CVE-2023-42115 and the related CVE-2023-42114 and CVE-2023-42116 vulnerabilities. Organizations should upgrade promptly; where immediate patching is not possible, they should disable exposed authentication features and limit remote SMTP access. Other disclosed issues depend on configurations such as SPA/NTLM authentication, an untrusted Proxy Protocol proxy, SPF ACL use, or reliance on an untrusted DNS resolver.
Sep 3, 2026