erroneo.us
Search all guides⌘K

Security Digest · Apr 18, 2025 · Vulnerability · Other

Active! mail CVE-2025-42599: Exploited Webmail Overflow

Unauthenticated stack overflow in Qualitia Active! mail 6, used as a zero-day against IIJ. Fixed in BuildInfo 6.60.06008562. Confirm the build, hunt.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

The fix has been out since April 2025; the job now is to prove every Active! mail 6 install, including hosted ones, runs BuildInfo 6.60.06008562 or later, and to have any server that ran an older build checked for compromise.

Who must act: Organizations that run Active! mail 6 on premises or receive it from a hosting or mail provider, especially if any instance stayed on BuildInfo 6.60.05008561 or earlier after April 2025.

Who can relax: Teams that do not use Active! mail, or that confirmed the April 2025 build and saw no anomalies, need no further action beyond normal patching.

Affected
Active! mail 6 BuildInfo 6.60.05008561 and earlier, all supported operating systems
Fixed in
Active! mail 6 BuildInfo 6.60.06008562 (released April 16, 2025)
CVSS
9.8 (v3.0, CNA)
EPSS
3.4% (percentile 89)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Active! mail 6 instance, including ones run for you by a hosting or mail provider, and record the BuildInfo each one reports.
  2. Upgrade anything at BuildInfo 6.60.05008561 or earlier to 6.60.06008562 or a later Qualitia release.
  3. If an upgrade must wait, enable WAF request-body inspection and block oversized multipart/form-data headers, as JPCERT/CC describes.
  4. For any instance that ran a vulnerable build while reachable from the internet, ask Qualitia support for its compromise-investigation procedure.
  5. Rotate webmail passwords and any cloud-service credentials stored on hosts that may have been compromised.

How to check if you are affected or compromised

  • Search WAF and web server logs for POST requests to Active! mail with unusually large multipart/form-data part headers, the pattern JPCERT/CC's mitigation rule targets.
  • Look for crashes or restarts of the Active! mail process, since the bug can also cause denial of service.
  • Check the mail host for unexpected programs, scheduled tasks or outbound connections; IIJ found an unauthorized program running on its affected servers.
  • Ask any provider that hosted Active! mail for you whether it was affected in April 2025.

What happened#

On April 18, 2025, Qualitia published an advisory for a stack-based buffer overflow (CWE-121) in Active! mail 6, a webmail client widely used by Japanese companies, universities and public bodies. A remote, unauthenticated attacker can send a crafted request that leads to arbitrary code execution or denial of service. Qualitia had shipped the fix two days earlier under an urgent notice with no details. JVN#22348866 states that "attacks exploiting the vulnerability has been observed." The CVE record carries the JPCERT/CC score of CVSS 3.0 9.8. CISA added the flaw to the KEV catalog on April 28, 2025.

The best-documented victim is IIJ. On April 15, IIJ said its Secure MX mail service had been accessed without authorization from August 3, 2024. Attackers ran a malicious program on the service's servers, and up to 4,072,650 mail accounts were potentially exposed. A week later, IIJ attributed the intrusion to JVN#22348866, a flaw no one knew about until its investigation. It confirmed leaks affecting 586 contracts, including 311,288 mail accounts and passwords, mail content for 6 contracts, and stored credentials for other cloud services for 488 contracts.

Who is affected#

Active! mail 6 BuildInfo 6.60.05008561 and earlier, on every supported operating system. The fix is BuildInfo 6.60.06008562. Many organizations get Active! mail from a hosting or mail provider rather than running it themselves. BleepingComputer reported that hosting providers Kagoya Japan and WADAX suspended their Active! mail services after suspected attacks. It also quoted a Macnica researcher who counted at least 227 internet-exposed servers, 63 of them at universities.

Do you really need to act?#

Most likely you already patched. The bug is unauthenticated, network-reachable and was used as a zero-day, so treat any instance still on an old build as compromised, not just unpatched. For everyone else, the open question is whether they were breached before April 16, 2025. At IIJ, attackers had access from August 2024 and were only spotted in April 2025. Qualitia's advisory, last updated May 28, 2025, says a compromise check exists. Because the procedure is complex, Qualitia offers it only through its support center.

What to do now#

  1. List every Active! mail 6 instance, including hosted ones. For each, get the BuildInfo from the administrator or the provider.
  2. Upgrade anything at 6.60.05008561 or earlier to 6.60.06008562 or a later release.
  3. If you cannot upgrade, apply the JPCERT/CC mitigations: enable HTTP request-body inspection in your WAF, and block requests with oversized multipart/form-data headers. JPCERT/CC's ModSecurity example is SecRequestBodyAccess On plus SecRule MULTIPART_PART_HEADERS "@ge 4000" "phase:2,t:length,deny,status:403,id:990178". Test the rule before you enforce it.
  4. For any instance that was internet-facing on a vulnerable build, open a case with Qualitia support for the compromise investigation.
  5. Rotate webmail passwords and any third-party cloud credentials stored on hosts that may be affected.

How to tell if you were hit#

Review WAF and web server logs from before your upgrade for POST requests to Active! mail with very large multipart part headers, and note any application crashes around the same time. On the server, look for unexpected binaries, scheduled jobs or outbound connections. IIJ found an unauthorized program running on its servers. If you use a provider, ask in writing whether your tenant ran a vulnerable build and whether it was investigated. If compromise is likely, rebuild the host and rotate every credential it handled.

Timeline#

  • — Unauthorized access to IIJ Secure MX begins, according to IIJ.
  • — IIJ discloses the Secure MX breach.
  • — Qualitia releases the fixed build with an urgent notice.
  • — Qualitia's advisory, JVN#22348866, JPCERT-AT-2025-0010 and CVE-2025-42599 are published.
  • — IIJ attributes its breach to the Active! mail flaw.
  • — CISA adds CVE-2025-42599 to KEV, with a May 19 federal deadline.
  • — Qualitia updates its advisory: compromise checks are available through support.

Vulnerability records

  • CVE-2025-42599 · KEV 2025-04-28 · Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. QUALITIA — Important notice regarding a vulnerability in Active! mail 6 (Japanese) qualitia.com
  2. QUALITIA — Urgent notice: fixed version of Active! mail released (Japanese) qualitia.com
  3. JVN — JVN#22348866: Active! mail vulnerable to stack-based buffer overflow jvn.jp
  4. JPCERT/CC — JPCERT-AT-2025-0010: Alert on stack-based buffer overflow in Active! mail (Japanese) jpcert.or.jp
  5. CVE record — CVE-2025-42599 cve.org
  6. NVD — CVE-2025-42599 nvd.nist.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2025-42599 cisa.gov
  8. IIJ — Leak of customer information in IIJ Secure MX Service (April 15, 2025, Japanese) iij.ad.jp
  9. IIJ — Apology and report on the IIJ Secure MX Service leak (April 22, 2025, Japanese) iij.ad.jp

Coverage and analysis

  1. BleepingComputer — Active! Mail RCE flaw exploited in attacks on Japanese orgs bleepingcomputer.com