MailGates/MailAudit CRLF Injection Exposes System Files

A critical CRLF Injection vulnerability, identified as CVE-2026-6351, has been reported in Openfind’s MailGates and MailAudit products. According to the National Vulnerability Database, this flaw allows unauthenticated remote attackers to exploit the system, granting them the ability to read sensitive system files. This is a pretty gnarly bug, especially for email security solutions that are often internet-facing.

The National Vulnerability Database has assigned CVE-2026-6351 a CVSS v3.1 score of 7.5, classifying it as HIGH severity. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N highlights a network-exploitable vulnerability with low attack complexity, requiring no privileges or user interaction. The primary impact noted is high confidentiality, meaning attackers can gain significant access to information.