Is CVE-2026-44400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44400 being exploited in the wild.

How severe is CVE-2026-44400?

High severity, with a CVSS score of 8.1, published 8 May 2026.

Which products and versions are affected?

MailEnable Enterprise Premium 10.55 and earlier; MailEnable Enterprise Premium Edition 10.55 and earlier.

Is there a fix for CVE-2026-44400?

A patch was published on 2026-03-16: Fixed in version 10.56 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44400 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44400?

Check whether you run MailEnable Enterprise Premium, MailEnable Enterprise Premium Edition or Mailenable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44400: MailEnable Enterprise Premium auth bypass in WebAdmin mobile portal

CVE-2026-44400 · Severity: high · CVSS 8.1 · Published 2026-05-08

MailEnable Enterprise Premium, a popular Windows-based email server, contains a security flaw in its mobile administration portal. This vulnerability allows a standard email user to gain full administrative control over the entire mail server by reusing security tokens from their webmail session. An attacker could use this access to read any user's email, delete accounts, or change server-wide security settings, potentially leading to a total compromise of the organization's email infrastructure.

Technologies: Mailenable. Vendors: MailEnable.

Quick answers

Is CVE-2026-44400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44400 being exploited in the wild.
How severe is CVE-2026-44400?: High severity, with a CVSS score of 8.1, published 8 May 2026.
Which products and versions are affected?: MailEnable Enterprise Premium 10.55 and earlier; MailEnable Enterprise Premium Edition 10.55 and earlier.
Is there a fix for CVE-2026-44400?: A patch was published on 2026-03-16: Fixed in version 10.56 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44400 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44400?: Check whether you run MailEnable Enterprise Premium, MailEnable Enterprise Premium Edition or Mailenable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-639) exists in the WebAdmin mobile portal of MailEnable Enterprise Premium. The flaw allows an attacker to obtain an 'AuthenticationToken' cookie from the standard WebMail login endpoint by utilizing the 'PersistentLogin' parameter. This token, originally intended for low-privileged webmail access, can be replayed against the WebAdmin portal to bypass authentication checks. Successful exploitation grants the attacker highly privileged administrative access to the mail server. The vulnerability is fixed in version 10.56.

Affected products

MailEnable MailEnable Enterprise Premium 10.55 and earlier

Timeline

2026-03-16: patched: Fixed in version 10.56
2026-05-08: disclosed: Initial disclosure and CVE assignment
2026-05-08: advisory: VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.