XXE Information Disclosure in MailEnable (CVE-2026-114552) Allows Authenticated Data Exposure
MailEnable’s mail server contains an XML External Entity (XXE) flaw (CVE‑2026‑114552) that lets authenticated attackers disclose sensitive files. The issue underscores the need for hardened XML parsing controls to satisfy audit‑ready data‑protection objectives.
ADTP Breach Watch· October 27, 2026· Zero Day Initiative
SeverityMedium
Type🐛 Vulnerability
ConfidenceHigh
ReportedOct 27, 2026
Technology & SaaSTECH_SAASVulnerability Exploit
What happened
The ZDI‑26‑811 advisory reports that the `parseObjectResponse` method in MailEnable fails to restrict XML External Entity references. An attacker with valid credentials can send crafted XML that forces the service account to resolve external entities, leaking configuration files or other sensitive data. The vulnerability scores 6.5 (CVSS) and is fixed in MailEnable version 10.60.
Why it matters for trust and compliance
The flaw highlights the control objective of secure configuration and input validation, a requirement across most frameworks for protecting confidentiality of data.
Provides evidence that XML parser hardening must be monitored as part of continuous control assurance.
Supports audit trails showing remediation of data‑exposure risks in email infrastructure.
Who is affected
TECH_SAAS
Recommended actions
Upgrade MailEnable to version 10.60 or later.
Disable external entity resolution in XML parsers and verify the setting.
Run an XXE‑specific test as part of your regular vulnerability‑scan schedule.
Document the remediation steps and retain evidence for audit readiness.
Details
CVEs
CVE-2026-114552
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.