A Cross-Site Request Forgery vulnerability in the Axigen Mail Server WebAdmin interface poses a critical risk by allowing attackers to perform unauthorized administrative actions.

This is a Cross-Site Request Forgery (CSRF) flaw where the WebAdmin interface processes state-changing GET requests via the _s parameter. The vulnerability allows an attacker to execute arbitrary administrative commands, such as creating new administrator accounts, if an authenticated administrator clicks a malicious URL.

Successful exploitation allows an unauthenticated attacker to manipulate mail server configurations or escalate privileges by creating rogue administrative accounts. This represents a severe threat to the confidentiality, integrity, and availability of the mail infrastructure, justifying the high CVSS score of 8.8. Such unauthorized access could lead to full system compromise, data exfiltration, and significant organizational disruption.

Immediate Action: Update the Axigen Mail Server to version 10.5.57, 10.6.26, or a later version immediately.

Proactive Monitoring: Review WebAdmin access logs for suspicious administrative actions or the unexpected creation of new user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious base64-encoded command sequences within the _s parameter.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the potential for full administrative takeover of the mail server, this vulnerability should be prioritized for immediate remediation. Organizations must apply the vendor-provided patches as soon as possible to neutralize the risk of unauthorized configuration changes and account creation.