CVE-2025-42599: Qualitia Active! Mail unauthenticated buffer-overflow RCE, exploited in the wild
The short version: Active! Mail — a webmail server widely used in Japan — has a stack-based buffer overflow (CVE-2025-42599) that lets a remote, unauthenticated attacker execute code or knock the service offline with a single crafted request. It scores 9.8, it's been exploited in the wild, and it's in CISA's Known Exploited Vulnerabilities catalog. If you run an affected build, patch it now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.08% · 86.22th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-05-19 |
| Known exploited? | Yes — active exploitation reported at disclosure |
| Vulnerability type | CWE-121 stack-based buffer overflow → unauthenticated remote code execution / denial of service |
| Requires authenticated session? | No — pre-authentication |
| Affected | Active! mail 6, BuildInfo 6.60.05008561 and earlier |
| Fixed in | 6.60.05008562 (see Qualitia advisory) |
What you need to know
CVE-2025-42599 is a stack-based buffer overflow. The Active! Mail server mishandles a specially crafted request, writing past the bounds of a fixed-size buffer on the stack — the classic memory-corruption primitive that, exploited carefully, hands an attacker arbitrary code execution, and exploited crudely simply crashes the service.
A few reasons this earns urgency:
- It's pre-authentication. No credential, no chain — a single request to the webmail endpoint is the whole attack surface.
- It's a mail server. Compromise reaches message content and the accounts behind it, and a downed webmail service is an outage in its own right.
- It's confirmed exploited and KEV-listed — the theoretical is operational.
How serious we see it
High — the 9.8 holds up.
Unauthenticated, network-reachable code execution on an internet-facing mail server, confirmed exploited in the wild, is top-of-queue by any measure. The bounded, reassuring part is that it's narrow and fixable: it affects a specific version line, the fixed build (6.60.05008562) is published, and you can determine quickly whether you run an exposed instance. As with any flaw exploited before you patched, treat "patched" and "clean" as separate questions.
Recommendations
Straight from Qualitia's advisory and CISA:
- Patch now. Upgrade Active! Mail to 6.60.05008562 or later.
- Assume nothing — hunt. Review webmail and system logs for crashes, unexpected process execution, or anomalous requests before your patch date.
- If you find indicators, respond. Isolate the server, rotate credentials for accounts served by it, and investigate for lateral movement.
- Harden exposure. Restrict who can reach the webmail interface; put it behind a VPN or reverse proxy where feasible.
- Confirm your exposure first. Verify whether you run an affected Active! Mail build reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing Active! Mail interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, outside-in view means an exposed, affected mail server is already mapped when a flaw like this breaks, so you can go straight to patch-and-verify.