---
title: "Active! mail CVE-2025-42599: Exploited Webmail Overflow"
url: https://erroneo.us/security/briefs/active-mail-cve-2025-42599-stack-overflow-rce/
description: "Unauthenticated stack overflow in Qualitia Active! mail 6, used as a zero-day against IIJ. Fixed in BuildInfo 6.60.06008562. Confirm the build, hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-04-18
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-42599"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Active! mail CVE-2025-42599: Exploited Webmail Overflow

**Verdict: Check exposure.** The fix has been out since April 2025; the job now is to prove every Active! mail 6 install, including hosted ones, runs BuildInfo 6.60.06008562 or later, and to have any server that ran an older build checked for compromise.

- **Who must act:** Organizations that run Active! mail 6 on premises or receive it from a hosting or mail provider, especially if any instance stayed on BuildInfo 6.60.05008561 or earlier after April 2025.
- **Who can relax:** Teams that do not use Active! mail, or that confirmed the April 2025 build and saw no anomalies, need no further action beyond normal patching.
- **Affected:** Active! mail 6 BuildInfo 6.60.05008561 and earlier, all supported operating systems
- **Fixed:** Active! mail 6 BuildInfo 6.60.06008562 (released April 16, 2025)
- **CVEs:** CVE-2025-42599
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Active! mail 6 instance, including ones run for you by a hosting or mail provider, and record the BuildInfo each one reports.
2. Upgrade anything at BuildInfo 6.60.05008561 or earlier to 6.60.06008562 or a later Qualitia release.
3. If an upgrade must wait, enable WAF request-body inspection and block oversized multipart/form-data headers, as JPCERT/CC describes.
4. For any instance that ran a vulnerable build while reachable from the internet, ask Qualitia support for its compromise-investigation procedure.
5. Rotate webmail passwords and any cloud-service credentials stored on hosts that may have been compromised.

### How to check if you are affected

- Search WAF and web server logs for POST requests to Active! mail with unusually large multipart/form-data part headers, the pattern JPCERT/CC's mitigation rule targets.
- Look for crashes or restarts of the Active! mail process, since the bug can also cause denial of service.
- Check the mail host for unexpected programs, scheduled tasks or outbound connections; IIJ found an unauthorized program running on its affected servers.
- Ask any provider that hosted Active! mail for you whether it was affected in April 2025.

## What happened

On April 18, 2025, Qualitia published an [advisory](https://www.qualitia.com/jp/news/2025/04/18_1030.html) for a stack-based buffer overflow (CWE-121) in Active! mail 6, a webmail client widely used by Japanese companies, universities and public bodies. A remote, unauthenticated attacker can send a crafted request that leads to arbitrary code execution or denial of service. Qualitia had shipped the fix two days earlier under an [urgent notice](https://www.qualitia.com/jp/news/2025/04/16_1800.html) with no details. [JVN#22348866](https://jvn.jp/en/jp/JVN22348866/) states that "attacks exploiting the vulnerability has been observed." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-42599) carries the JPCERT/CC score of CVSS 3.0 9.8. CISA added the flaw to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599) on April 28, 2025.

The best-documented victim is IIJ. On [April 15](https://www.iij.ad.jp/news/pressrelease/2025/0415.html), IIJ said its Secure MX mail service had been accessed without authorization from August 3, 2024. Attackers ran a malicious program on the service's servers, and up to 4,072,650 mail accounts were potentially exposed. A week later, IIJ [attributed the intrusion](https://www.iij.ad.jp/news/pressrelease/2025/0422-2.html) to JVN#22348866, a flaw no one knew about until its investigation. It confirmed leaks affecting 586 contracts, including 311,288 mail accounts and passwords, mail content for 6 contracts, and stored credentials for other cloud services for 488 contracts.

## Who is affected

Active! mail 6 BuildInfo 6.60.05008561 and earlier, on every supported operating system. The fix is BuildInfo 6.60.06008562. Many organizations get Active! mail from a hosting or mail provider rather than running it themselves. [BleepingComputer](https://www.bleepingcomputer.com/news/security/active-mail-rce-flaw-exploited-in-attacks-on-japanese-orgs/) reported that hosting providers Kagoya Japan and WADAX suspended their Active! mail services after suspected attacks. It also quoted a Macnica researcher who counted at least 227 internet-exposed servers, 63 of them at universities.

## Do you really need to act?

Most likely you already patched. The bug is unauthenticated, network-reachable and was used as a zero-day, so treat any instance still on an old build as compromised, not just unpatched. For everyone else, the open question is whether they were breached before April 16, 2025. At IIJ, attackers had access from August 2024 and were only spotted in April 2025. Qualitia's advisory, last updated May 28, 2025, says a compromise check exists. Because the procedure is complex, Qualitia offers it only through its support center.

## What to do now

1. List every Active! mail 6 instance, including hosted ones. For each, get the BuildInfo from the administrator or the provider.
2. Upgrade anything at 6.60.05008561 or earlier to 6.60.06008562 or a later release.
3. If you cannot upgrade, apply the [JPCERT/CC](https://www.jpcert.or.jp/at/2025/at250010.html) mitigations: enable HTTP request-body inspection in your WAF, and block requests with oversized multipart/form-data headers. JPCERT/CC's ModSecurity example is `SecRequestBodyAccess On` plus `SecRule MULTIPART_PART_HEADERS "@ge 4000" "phase:2,t:length,deny,status:403,id:990178"`. Test the rule before you enforce it.
4. For any instance that was internet-facing on a vulnerable build, open a case with Qualitia support for the compromise investigation.
5. Rotate webmail passwords and any third-party cloud credentials stored on hosts that may be affected.

## How to tell if you were hit

Review WAF and web server logs from before your upgrade for POST requests to Active! mail with very large multipart part headers, and note any application crashes around the same time. On the server, look for unexpected binaries, scheduled jobs or outbound connections. IIJ found an unauthorized program running on its servers. If you use a provider, ask in writing whether your tenant ran a vulnerable build and whether it was investigated. If compromise is likely, rebuild the host and rotate every credential it handled.

## Timeline

- Aug 3, 2024 — Unauthorized access to IIJ Secure MX begins, according to IIJ.
- Apr 15, 2025 — IIJ discloses the Secure MX breach.
- Apr 16, 2025 — Qualitia releases the fixed build with an urgent notice.
- Apr 18, 2025 — Qualitia's advisory, JVN#22348866, JPCERT-AT-2025-0010 and CVE-2025-42599 are published.
- Apr 22, 2025 — IIJ attributes its breach to the Active! mail flaw.
- Apr 28, 2025 — CISA adds CVE-2025-42599 to KEV, with a May 19 federal deadline.
- May 28, 2025 — Qualitia updates its advisory: compromise checks are available through support.

## Sources

1. [QUALITIA — Important notice regarding a vulnerability in Active! mail 6 (Japanese)](https://www.qualitia.com/jp/news/2025/04/18_1030.html)
2. [QUALITIA — Urgent notice: fixed version of Active! mail released (Japanese)](https://www.qualitia.com/jp/news/2025/04/16_1800.html)
3. [JVN — JVN#22348866: Active! mail vulnerable to stack-based buffer overflow](https://jvn.jp/en/jp/JVN22348866/)
4. [JPCERT/CC — JPCERT-AT-2025-0010: Alert on stack-based buffer overflow in Active! mail (Japanese)](https://www.jpcert.or.jp/at/2025/at250010.html)
5. [CVE record — CVE-2025-42599](https://www.cve.org/CVERecord?id=CVE-2025-42599)
6. [NVD — CVE-2025-42599](https://nvd.nist.gov/vuln/detail/CVE-2025-42599)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-42599](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599)
8. [IIJ — Leak of customer information in IIJ Secure MX Service (April 15, 2025, Japanese)](https://www.iij.ad.jp/news/pressrelease/2025/0415.html)
9. [IIJ — Apology and report on the IIJ Secure MX Service leak (April 22, 2025, Japanese)](https://www.iij.ad.jp/news/pressrelease/2025/0422-2.html)
10. [BleepingComputer — Active! Mail RCE flaw exploited in attacks on Japanese orgs](https://www.bleepingcomputer.com/news/security/active-mail-rce-flaw-exploited-in-attacks-on-japanese-orgs/)

---
Source page: https://erroneo.us/security/briefs/active-mail-cve-2025-42599-stack-overflow-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt