CVE-2025-68723 is a critical set of three stored cross site scripting flaws (CVSS 9.0) in the Axigen Mail Server WebAdmin interface. Releases before 10.5.57 are affected, so upgrade to 10.5.57 or later. Also review which administrators hold which privileges, since the risk is one admin acting through another.
What's affected
- Axigen Mail Server before 10.5.57.
- Fixed version: 10.5.57.
- Three locations: the log file name parameter in the Local Services Log page, certificate file content in the SSL Certificates View Usage feature, and the Certificate File name parameter in WebMail Listeners SSL settings.
How to check if you're exposed
Sign in to WebAdmin and read the version on the main page, or read it from the Axigen service information on the host. Anything below 10.5.57 needs the update.
Then list your WebAdmin accounts. The risk described is a low privileged administrator causing a higher privileged one to take actions, so the number of accounts, and who holds delegated rights, sets your exposure.
What to do now
- Check the Axigen version on every mail server.
- Upgrade to 10.5.57 or later using the vendor's download page and upgrade guide.
- Reduce the number of WebAdmin accounts and give delegated admins only the rights they need.
- Limit access to the WebAdmin port to a management network.
- Ask administrators to avoid browsing unrelated sites in the same session as WebAdmin.
Mail servers deserve extra care with admin rights. Consider requiring separate accounts for daily administration and for sensitive changes, and log what each does. If a low privileged account is ever compromised, the scope of what it can trick another administrator into doing is then smaller.
Why it matters
The weakness is CWE-79, cross site scripting. Values that an administrator can enter, such as a log file name or a certificate file name, are shown back on pages without being encoded. That content is stored, so it runs for whoever opens the page later.
The score reflects a scope change and the need for a victim to view the page. The advisory describes the practical result as privilege escalation inside the admin console, where a low privileged admin could force a high privileged one to act. A mail server holds every mailbox, so admin rights are worth protecting. The record does not list this CVE as exploited in the wild.
Stored XSS in an admin console is a case where the attacker needs some access first. That is why the number of admin accounts and the separation of duties matter. If every administrator has every right, a low privilege account does not exist, and the scope change in the score matters less. If you have delegated administrators, treat their accounts with the care you give to the highest role they can influence.
Browser hygiene helps, too. Use a dedicated browser profile for mail server administration, with no extensions, and sign out when done.
After the upgrade, review certificate and log settings in WebAdmin for entries you do not recognise, since the three affected fields are the places where injected content would be stored.
Quick check
Who can exploit CVE-2025-68723?
An administrator with some WebAdmin rights, per the record, targeting another administrator who views an affected page. Upgrade to 10.5.57.
Sources
Last reviewed: 19 October 2026.
