CVE-2025-34491

Name of the Vulnerable Software and Affected Versions GFI MailEssentials versions prior to 21.8

Description The issue is related to a .NET deserialization problem. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET data when joining a Multi-Server setup.

Recommendations For GFI MailEssentials versions prior to 21.8, update to version 21.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Multi-Server setup to minimize the risk of exploitation.