IceWarp X-File-Operation Header Command Injection RCE

Successful exploitation gives an unauthenticated remote attacker arbitrary code execution on the target IceWarp server with the highest local privileges available to the service context: SYSTEM on Windows and root on Linux, according to the provided reporting. This can enable full server compromise, including installation of malware, modification or destruction of data, credential theft, access to mail and collaboration data handled by IceWarp, use of the host for lateral movement, and service disruption. The provided material also notes high impact to confidentiality, integrity, and availability.

If immediate patching is not possible, reduce exposure to the vulnerable HTTP interface as much as possible. Based on the provided content, temporary mitigations include filtering, removing, or sanitizing the X-File-Operation header before it reaches IceWarp, restricting network access to trusted management paths only, and monitoring for suspicious or unauthorized system-call activity and anomalous requests targeting this header. Because the vulnerability is unauthenticated and network-reachable, internet exposure should be minimized until patched. The content also notes that patching alone does not address prior compromise, so defenders should review logs and host activity for signs of exploitation.

Upgrade IceWarp to a fixed version. The provided content states fixes were released in October 2025 and identifies the following patched versions: IceWarp Epos Update 2 14.2.0.9 or newer, IceWarp Epos Update 1 14.1.0.19 or newer, IceWarp Epos 14.0.0.18, and Deep Castle 13.0.3.13. For cloud instances, the patch was reportedly deployed immediately by the vendor. IceWarp support also advised customers to back up the entire server before upgrading. Because the supplied content states patching does not remediate historic compromise, organizations should also perform post-patch compromise assessment and incident response review if exposure is suspected.