CVE-2026-2234

Critical

Published: 09 February 2026

Published

09 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0009 25.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2234 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly addresses the missing authentication by mandating restrictions on permitted actions without identification or authentication, preventing unauthenticated read and modify access to user mail content.

AC-3 Access Enforcement good match

prevent

Enforces access control policies that require authentication prior to allowing logical access to sensitive mail content, mitigating the unauthenticated remote exploitation.

SC-14 Public Access Protections good match

prevent

Provides protections for public-facing systems like the mail application to prevent unauthorized access, modification, or disclosure of user mail content by unauthenticated attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1114.002 Remote Email Collection Collection

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

attack.mitre.org →

Why these techniques?

Missing authentication in public-facing mail app directly enables remote exploitation (T1190) and unauthorized remote email access/modification (T1114.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content.

Deeper analysisAI

CVE-2026-2234 is a Missing Authentication vulnerability (CWE-306) affecting C&Cm@il, a mail application developed by HGiga. Published on 2026-02-09T08:16:12.287, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The issue enables unauthenticated remote attackers to read and modify any user's mail content due to the absence of proper authentication mechanisms.

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows remote adversaries to achieve high confidentiality and integrity impacts, permitting them to access sensitive email data belonging to any user and arbitrarily alter mail contents without privileges.

Advisories from TWCERT/CC provide further details on this vulnerability, available at https://www.twcert.org.tw/en/cp-139-10704-d5aba-2.html and https://www.twcert.org.tw/tw/cp-132-10703-3d02f-1.html.