Cyber Resilience

CVE-2026-6351

High

Published: 16 April 2026

Published
16 April 2026
Modified
19 May 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0059 43.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-6351 is a high-severity CRLF Injection (CWE-93) vulnerability in Org (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-6351 is a CRLF Injection vulnerability (CWE-93) affecting MailGates and MailAudit products developed by Openfind. Published on 2026-04-16, the vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to its potential for significant confidentiality impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation allows attackers to read system files on the affected system.

Advisories from TWCERT/CC provide further details on this vulnerability, available at https://www.twcert.org.tw/en/cp-139-10843-9ff91-2.html and https://www.twcert.org.tw/tw/cp-132-10844-1405d-1.html.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.

CWE(s)
CWE-93

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CRLF injection in public-facing mail products enables unauthenticated remote exploitation (T1190) to read system files, directly facilitating local data collection (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-39983Shared CWE-93
CVE-2026-41230Shared CWE-93
CVE-2025-28357Shared CWE-93
CVE-2026-39394Shared CWE-93
CVE-2026-21428Shared CWE-93
CVE-2026-32993Shared CWE-93
CVE-2026-5140Shared CWE-93
CVE-2026-39849Shared CWE-93
CVE-2026-1714Shared CWE-93
CVE-2026-33128Shared CWE-93

Affected Assets

Org
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents CRLF injection exploits by validating and sanitizing untrusted inputs to block malicious CRLF sequences in MailGates/MailAudit.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of the specific CRLF injection flaw (CVE-2026-6351), preventing remote file disclosure through timely patching.

SI-15 Information Output Filtering partial match
prevent

Filters information outputs to neutralize CRLF characters, mitigating header injection effects that enable system file reading in responses.

References