CVE-2024-1619 is a medium severity (CVSS 6.1) flaw in Kaspersky Security 8.0 for Linux Mail Server. An attacker could potentially force an administrator to click a malicious link and perform unauthorized actions. Kaspersky says the fix is Kaspersky Security for Linux Mail Server 10, and offers a browser separation workaround if you cannot update.
What's affected
Kaspersky's advisory, issued on 1 February 2024, names Kaspersky Security for Linux Mail Server 8 (released on 14 May 2018) as the affected application. It calls this an outdated version of the product. The fixed version listed is Kaspersky Security for Linux Mail Server 10.
The NVD record scores the issue 6.1 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. That means it is reachable over the network, needs no privileges, and needs a user to act. The record's weakness class is CWE-74 (injection). Kaspersky's page describes the impact in plain terms rather than naming a technique, so this post does the same.
How to check if you're exposed
Work out whether any mail relay in your estate still runs the 8.x line of the product. Most inventories record the product and version, so start there.
# on the mail server, using the package manager that installed it
rpm -qa | grep -i kaspersky
dpkg -l | grep -i kaspersky
If the version string starts with 8, you are in the affected group. If you cannot find the package, check the vendor's installation directory and the administrator console about page. Also ask who administers the console and from which workstation, because the risk here depends on what the admin's browser is doing while signed in.
What to do now
- Confirm the product version on every Linux mail server and flag any 8.x installation.
- Plan the move to Kaspersky Security for Linux Mail Server 10, as the advisory recommends. Check the advisory for the current installation guidance.
- Until you can move, have administrators use two separate browsers: one only for managing the product and another for visiting third party sites. This is Kaspersky's own interim advice.
- Do not open links from email or chat while signed in to the management console.
- Record the decision and an end date for the old version in your risk register.
Why it matters
This is a case where the product is old and the vendor has said so. The weakness is classed as CWE-74 (injection), the broad family of problems where untrusted input changes how a system interprets a request. Here the practical outcome is that an administrator, acting with their own session, can be made to do something they did not intend.
The score is medium because the attacker needs the admin to take an action, and the impact on confidentiality and integrity is rated low. That does not make it harmless. Admin consoles for mail security products sit in a sensitive place, so even a medium flaw deserves a decision rather than silence. The NVD record does not flag the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Is CVE-2024-1619 exploited in the wild?
The NVD record does not mark it as a CISA Known Exploited Vulnerability, and the advisory we read does not say it is exploited.
Sources
Last reviewed: 19 October 2026.
