Loading story…
Openfind MailGates/MailAudit and Sagredo qmail were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. CVE-2026-6350 affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (CWE-121) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a CVSS v3.1 score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by TWCERT/CC.
A second flaw, CVE-2026-41113, affects Sagredo qmail versions before 2026.04.07 and enables remote code execution through tls_quit because qmail-remote.c uses popen in the notlshosts_auto component, a command injection issue tracked as CWE-78. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request #42, and the patched v2026.04.07 release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry documented a remote code execution vulnerability in Sagredo qmail's tls_quit functionality affecting versions before 2026.04.07. The record says it was received by cve@mitre.org and classifies the issue as OS command injection.
A new CVE entry documented a stack-based buffer overflow in Openfind MailGates/MailAudit that could let unauthenticated remote attackers control execution flow and run arbitrary code. The record notes it was received by twcert@cert.org.tw and references TWCERT/CC advisories.
Sagredo qmail version 2026.04.07 was released to address a remote code execution flaw in tls_quit caused by use of popen in qmail-remote.c. The CVE entry states affected versions are those before 2026.04.07 and references the fixing commit, pull request #42, and the release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **remote code execution** flaw tracked as **`CVE-2026-41113`** was disclosed in the `sagredo-dev/qmail` fork after researchers found that `qmail-remote` could build and execute a shell command from an attacker-controlled MX hostname. The bug sits in `tls_quit()` and was introduced by the `notlshosts_auto` feature added in October 2024, which automatically records hosts that fail TLS. If a target mail server sends mail to a domain whose DNS MX record is controlled by an attacker, a crafted hostname containing shell metacharacters can be passed through `sprintf()` into `popen()`, allowing arbitrary commands to run as the **`qmailr`** user when `control/notlshosts_auto` is enabled. The issue affects `sagredo-dev/qmail` versions **`v2024.10.26` through `v2026.04.02`** and was fixed in **`v2026.04.07`** by commit **`749f607`**, which removes shell execution, adds stricter FQDN validation, and replaces the vulnerable logic with safer file handling using `open()` and `snprintf()`. Public writeups and a GitHub repository published technical analysis, a Docker-based reproduction environment, and proof-of-concept exploit material showing the chain from crafted DNS responses to command execution, with one example writing `id` output to `/tmp/qmail_rce_proof`. The vulnerability carries a reported **CVSS 3.1 score of 8.2 (High)**, and maintainers advised users of the community-patched qmail fork—not original `qmail 1.03`—to upgrade immediately.
Jun 29, 2026
qmail has been hit by multiple remote code execution issues spanning legacy and actively maintained codebases. Qualys reported that **CVE-2005-1513**, long believed unexploitable in default installations, can be triggered remotely through `qmail-local` on Debian’s default qmail package by sending a nearly 4 GB mail header that causes an integer overflow in `stralloc_readyplus`, leading to a large buffer overflow and arbitrary command execution as any non-root local user. The same research also identified **CVE-2020-3811**, a recipient verification bypass in the bundled `qmail-verify` component, and **CVE-2020-3812**, a local information disclosure issue tied to privileged file existence checks.
Jun 29, 2026
TWCERT published two high-severity vulnerability entries affecting enterprise software from Taiwanese vendors. **Openfind MailGates/MailAudit** is affected by `CVE-2026-6351`, a `CWE-93` **CRLF injection** flaw that can be exploited by an unauthenticated remote attacker to read system files, creating a significant confidentiality risk. The issue was documented with CVSS v3.1 and v4.0 scoring and linked to TWCERT advisory references. TWCERT also disclosed `CVE-2026-5964` in **Digiwin EasyFlow .NET**, a `CWE-89` **SQL injection** vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL commands. Successful exploitation could let attackers read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Both disclosures highlight externally reachable attack paths requiring no authentication and raise immediate patching and exposure-review concerns for organizations using the affected products.
Jun 29, 2026