CVE-2025-34489

moderate-risk

Published 2025-04-28

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.

Do I need to act?

0.13% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (1)

Mailessentials

Affected Vendors

Gfi

References (3)

Exploit https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html

Release Notes https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/...

https://www.vulncheck.com/advisories/gfi-mailessentials-local-privilege-escalati...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal