Cleartext Credential Storage in MailEnable (CVE-2026-114551) Enables Remote Information Disclosure

What happened

A vulnerability (CVE‑2026‑114551) was disclosed for MailEnable mail server software. The flaw resides in the component that handles mailbox credentials, which are stored without encryption. An attacker can issue a remote request—no authentication required—to retrieve these cleartext credentials. The advisory, published by the Zero Day Initiative on 27 Oct 2026, assigns a CVSS 5.9 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). MailEnable released a patch in version 10.60 that removes the cleartext storage. No evidence of active exploitation has been reported.

Why it matters for trust and compliance

• Plaintext storage of authentication secrets breaches the control objective of protecting credential confidentiality, a core requirement across frameworks such as NIST CSF, ISO 27001, and SOC 2.
• Demonstrate encryption or vaulting of stored credentials to satisfy credential protection controls.
• Map the remediation to the relevant control objective and capture evidence for audit readiness.

Who is affected

Recommended actions

1. Upgrade MailEnable to version 10.60 or later.
2. Audit all MailEnable installations for cleartext credential storage.
3. Implement encryption or a secure credential vault for mailbox passwords.
4. Update monitoring to alert on any future cleartext storage configurations.

Details

CVEs

CVE-2026-114551