---
id: CVE-2026-119761
title: >-
  Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display
  Name
summary: >-
  Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored
  cross-site scripting vulnerability that allows unauthenticated remote
  attackers to inject script via unescaped sender display names in the
  conversation view. Attacker…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Axigen
product: Axigen Mail Server
affected:
  - mail_server >= 10.5.0 < 10.6.39
  - mail_server >= 10.7.0 < 10.7.1
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:19:53.886Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119761'
references:
  - url: 'https://www.axigen.com/kb/show/411'
  - url: 'https://www.axigen.com/updates/axigen-10.6.39'
  - url: 'https://www.axigen.com/updates/axigen-10.7.1'
  - url: >-
      https://www.vulncheck.com/advisories/axigen-mail-server-before-10.6.39-and-10.7.1-stored-xss-via-sender-display-name
    label: >-
      VulnCheck Advisory: Axigen Mail Server before 10.6.39 and 10.7.1 Stored
      XSS via Sender Display Name
tags:
  - cve.org
epss: 0.00319
epssPercentile: 0.25036
ingestedAt: '2026-11-05T16:24:31.217Z'
---

## Overview

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

## Affected

- `mail_server >= 10.5.0 < 10.6.39`
- `mail_server >= 10.7.0 < 10.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.