Update: CVE-2025-68624 (N-able Mail Assure cross-tenant spoofing): fix declared by the vendor
Alessandro Bertoldi BCS via Fulldisclosure ·
Update to the advisory posted on 15 June 2026: https://seclists.org/fulldisclosure/2026/Jun/10 CVE ID: CVE-2025-68624 GCVE ID: GCVE-128-2026-0001 Product: N-able Mail Assure (cloud-based multi-tenant SMTP relay) Status: DISPUTED in the CVE record; fix declared by the vendor on 10 November 2026, not independently verified Summary ------- N-able has stated, through its distributor, that it has developed a change to Mail Assure that validates the MAIL FROM domain against the account submitting the message and rejects attempts to send using a domain belonging to another Mail Assure customer. On 10 November 2026 N-able stated that "the enforcement is now active for all Mail Assure customers", with no action required by customers. N-able also stated that the change was communicated to Mail Assure customers in a notice sent in September 2026, and that no separate security advisory or release note is planned. The Mail Assure documentation now states that the "Enforce Sender Domain" setting is mandatory on all accounts. This fix is declared by the vendor and has not been independently verified by the reporters. Timeline since the original post -------------------------------- - 31 August 2026: GCVE-128-2026-0001 published by bcsec (GCVE Numbering Authority 128). - 14 September 2026: CVE-2025-68624 published by MITRE with the DISPUTED and exclusively-hosted-service tags. - 27 October 2026: status request sent to N-able PSIRT; only an automatic reply was received. The request was then pursued through the N-able distributor. - 6 November 2026: N-able stated that it has developed a change validating the MAIL FROM domain against the submitting account, to be enabled from November 2026. - 10 November 2026: N-able stated that the enforcement is active for all Mail Assure customers. References ---------- - Advisory and full timeline: https://bcsec.io/advisories.php#gcve-128-2026-0001 - GCVE record: https://db.gcve.eu/vuln/GCVE-128-2026-0001 - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68624 - Mail Assure documentation (Enforce Sender Domain): https://documentation.n-able.com/mail-assure/userguide/Content/C_Domain%20Level/domains/configuration.htm Alessandro Bertoldi Bertoldi Cybersecurity https://bcsec.io _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/