CVE-2025-34491: high-severity vulnerability in GFI MailEssentials
GFI MailEssentials < 21.8 MultiNode Insecure Deserialization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
GFI MailEssentials before version 21.8 has a flaw that allows authenticated users to run malicious code by sending specially crafted data during multi-server setup. This happens because the software unsafely processes serialized .NET objects without proper validation.
The vulnerability stems from insecure deserialization of .NET objects (CWE-502) in the MultiNode join mechanism. An authenticated remote attacker can exploit this by crafting malicious serialized payloads that execute arbitrary code upon deserialization, bypassing security controls during multi-server cluster configuration.
In the same product, most dangerous first.