Axigen develops a focused line of mail server and mobile webmail products that handle authentication, message routing, and user-facing web interfaces—a combination that concentrates risk around access control, session management, and input handling. Its vulnerabilities skew strongly toward critical-severity outcomes and frequently acquire public exploit code, while the recurring weakness classes—cross-site scripting, improper access control, CSRF, incorrect default permissions, and missing authentication for critical functions—reflect the authentication and boundary-enforcement demands of email infrastructure. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Axigen over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-31470MEDIUM An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitra | Jun 7, 2022 | 6.1 | 68 | NO | YES |
CVE-2023-48974CRITICAL Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter. | Feb 8, 2024 | 9.6 | 37 | NO | YES |
CVE-2023-23566CRITICAL A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail | Jan 13, 2023 | 9.8 | 29 | NO | NO |
CVE-2025-68723CRITICAL Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the log file name parame | Feb 5, 2026 | 9.0 | 27 | NO | NO |
CVE-2025-68722HIGH Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improper handling of the _s | Feb 5, 2026 | 8.8 | 27 | NO | NO |
CVE-2025-68721HIGH Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access con | Feb 5, 2026 | 8.1 | 26 | NO | NO |
CVE-2023-40355MEDIUM Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute ar | Feb 7, 2024 | 5.4 | 25 | NO | YES |
CVE-2012-2592MEDIUM Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email. | Jun 18, 2014 | 4.3 | 25 | NO | YES |
CVE-2020-26942CRITICAL An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subs | Mar 21, 2024 | 9.1 | 24 | NO | NO |
CVE-2025-68643MEDIUM Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploit this by deploying a | Feb 5, 2026 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Axigen.
Media articles that mention a CVE ID that affects a product developed by Axigen — matched by CVE ID, not by vendor name.