Is CVE-2026-29964 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29964 being exploited in the wild.

How severe is CVE-2026-29964?

Informational severity, with a CVSS score of 8.2, published 18 May 2026.

Which products and versions are affected?

HSC Labs MailInspector 5.3.3-7.

Is there a fix for CVE-2026-29964?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29964 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-29964?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29964: HSC MailInspector XSS in tap.php

CVE-2026-29964 · Severity: info · CVSS 8.2 · Published 2026-05-18

HSC MailInspector, an enterprise email security gateway used to protect organizations from phishing and malware, contains a vulnerability that allows attackers to execute malicious scripts in a user's web browser. By tricking a user into clicking a specially crafted link, an attacker could steal login sessions, hijack user accounts, or display fraudulent content. This could lead to unauthorized access to the email security management interface and potential exposure of sensitive corporate communications.

Quick answers

Is CVE-2026-29964 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29964 being exploited in the wild.
How severe is CVE-2026-29964?: Informational severity, with a CVSS score of 8.2, published 18 May 2026.
Which products and versions are affected?: HSC Labs MailInspector 5.3.3-7.
Is there a fix for CVE-2026-29964?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29964 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-29964?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in HSC MailInspector v5.3.3-7 within the '/mailinspector/tap/tap.php' endpoint. The root cause is the improper neutralization of user-controlled input, specifically failing to account for alternate or obfuscated JavaScript syntax (CWE-87). An unauthenticated remote attacker can exploit this by crafting a URL containing malicious scripts that are reflected back to the victim without adequate output encoding. Successful exploitation requires a victim to visit the malicious link, enabling the attacker to execute arbitrary JavaScript, steal session tokens, or perform actions on behalf of the user. While the NVD entry lists the severity as 'info' pending assessment, the researcher's advisory specifies a CVSS v3.1 score of 8.2.

Affected products

HSC Labs MailInspector 5.3.3-7

Timeline

2026-05-18: disclosed: Vulnerability disclosed by researcher Sql3t0
2026-05-18: advisory: CVE-2026-29964 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.