Active! mail RCE exploited in the wild
A critical stack-based buffer overflow in Active! mail 6 (CVE-2025-42599) is being actively exploited to achieve remote code execution; immediate patching is required.
Japan's IPA has issued an urgent security alert for a critical vulnerability in Active! mail 6, a web-based email system developed by QualityA. The flaw, tracked as CVE-2025-42599, is a stack-based buffer overflow that allows remote attackers to execute arbitrary code or cause denial-of-service conditions by sending specially crafted requests to vulnerable servers.
The vulnerability affects Active! mail 6 BuildInfo 6.60.05008561 and all earlier versions. According to IPA, exploitation attempts have already been observed in the wild, making this an active threat requiring immediate remediation. The vendor has released a patched version (BuildInfo 6.60.06008562) that addresses the vulnerability.
Organisations running affected versions of Active! mail should treat this as an emergency patch priority given the confirmed exploitation and the severity of potential impact—full server compromise via remote code execution.
Mentioned in this report
Detection guidance
Suspicious Shell Spawned by Java/Tomcat Process (Active! mail RCE)
Detects a command interpreter (cmd.exe, powershell.exe, sh) spawned as a child of a Java/Tomcat process, consistent with exploitation of the Active! mail CVE-2025-42599 stack-based buffer overflow leading to remote code execution on the underlying Java web application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned by Java/Tomcat Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \tomcat9.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh.exe
- \bash.exe
filter:
CommandLine|contains:
- scheduled_task_health_check
- ApplicationInsights
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts invoked by Java-based management tools
- Application health-check or monitoring agents that legitimately shell out from the
JVM
level: high
tags:
- attack.t1190
- attack.t1203
id: ac3fac07-22aa-5761-bc4a-cce550de95fd
status: experimental
author: Vorant
Recon or Enumeration Commands Executed by Java Web Server Process
Detects common post-exploitation reconnaissance commands (whoami, systeminfo, net, ipconfig) executed as child processes of a Java/Tomcat process, indicating possible successful exploitation of the Active! mail RCE vulnerability and subsequent attacker enumeration of the compromised host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands Spawned by Java Web Server Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \tomcat9.exe
Image|endswith:
- \whoami.exe
- \systeminfo.exe
- \net.exe
- \net1.exe
- \ipconfig.exe
- \hostname.exe
- \tasklist.exe
condition: selection
falsepositives:
- Application deployment or configuration scripts run from the JVM during maintenance
windows
level: medium
tags:
- attack.t1190
- attack.t1203
id: 1874a678-7a71-5952-b915-dede0498d673
status: experimental
author: Vorant
Outbound Network Connection Initiated by Java Web Server Process to Uncommon Port
Detects a Java/Tomcat process (hosting Active! mail) initiating outbound network connections to non-standard high ports, which may indicate a reverse shell or command-and-control channel established after successful exploitation of CVE-2025-42599. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Web Server Process Making Outbound Connection to Uncommon Port
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \tomcat9.exe
Initiated: 'true'
filter:
DestinationPort:
- 80
- 443
- 25
- 465
- 587
- 993
- 995
- 389
- 636
condition: selection and not filter
falsepositives:
- Legitimate outbound calls to LDAP, mail relay, or update servers configured on non-standard
ports
- Monitoring or license-check callbacks made by the mail application itself
level: medium
tags:
- attack.t1190
id: a5fd6145-8bbc-5739-971f-5b3bf20a7711
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20250418-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free