CVE-2026-2234
Published: 09 February 2026
Summary
CVE-2026-2234 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-2234 is a Missing Authentication vulnerability (CWE-306) affecting C&Cm@il, a mail application developed by HGiga. Published on 2026-02-09T08:16:12.287, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The issue enables unauthenticated remote attackers to read and modify any user's mail content due to the absence of proper authentication mechanisms.
Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows remote adversaries to achieve high confidentiality and integrity impacts, permitting them to access sensitive email data belonging to any user and arbitrarily alter mail contents without privileges.
Advisories from TWCERT/CC provide further details on this vulnerability, available at https://www.twcert.org.tw/en/cp-139-10704-d5aba-2.html and https://www.twcert.org.tw/tw/cp-132-10703-3d02f-1.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6922
Vulnerability details
C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in public-facing mail app directly enables remote exploitation (T1190) and unauthorized remote email access/modification (T1114.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing authentication by mandating restrictions on permitted actions without identification or authentication, preventing unauthenticated read and modify access to user mail content.
Enforces access control policies that require authentication prior to allowing logical access to sensitive mail content, mitigating the unauthenticated remote exploitation.
Provides protections for public-facing systems like the mail application to prevent unauthorized access, modification, or disclosure of user mail content by unauthenticated attackers.