Active! mail flaw exploited in wild
A critical stack-based buffer overflow in Qualitia's Active! mail webmail system is being actively exploited to achieve remote code execution or DoS.
IPA and JVN disclosed CVE-2025-42599, a stack-based buffer overflow vulnerability in Qualitia's Active! mail webmail product affecting version 6 BuildInfo 6.60.05008561 and earlier. The flaw carries a CVSS v3 score of 9.8 (critical) and allows a remote attacker to send a specially crafted request to execute arbitrary code or cause a denial-of-service condition on the affected system.
The advisory explicitly states that exploitation of this vulnerability has already been observed in the wild, making immediate patching a priority. Qualitia has released a fixed version, Active! mail 6 BuildInfo 6.60.06008562, and IPA urges affected organizations to update as soon as possible based on vendor-provided guidance.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20250418-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free