CVE-2026-47255
📛 CVE Title
(no title)
Description
AgenticMail API/storage and outbound relay hardening fixes
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.1 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Effective score
- 9.1 / 10 CRITICAL source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-47255
- Linked Threat
- CVE-2026-47255 — CVE-2026-47255
NVD / KEV / EPSS data refreshed 2026-06-29 03:01 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-46121 - Assigner
- GitHub_M
- Published
- Jul 20, 2026, 9:56:40 PM
- Updated
- Jul 21, 2026, 2:06:27 PM
- EUVD base score (CVSS 3.1)
-
8.2 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - EUVD-reported EPSS
- 0.1800
- Vendors
- agenticmail
- Products
-
@agenticmail/core (< 0.9.10)@agenticmail/api (< 0.9.32)
- Aliases
-
GHSA-wjjv-3mj2-39hf
ENISA description: AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.
EUVD references (7)
- https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf
- https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7
- https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155
- https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731
- https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d
- https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1#L1842
- https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/core/src/mail/sender.ts#L33
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-47255 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-47255 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blackswan-cybersecurity.com
Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch . None released as of April 17, 2026 ). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.
2026-06-19 02:31 UTC -
web:cyberpress.org
Microsoft has released its June 2026 Patch Tuesday security update, addressing 198 vulnerabilities across its product ecosystem, one of the largest single-month patches in recent memory.
2026-06-19 02:31 UTC -
web:cybersecuritynews.com
Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.
2026-06-19 02:31 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-06-19 02:31 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-06-19 02:31 UTC -
web:support.microsoft.com
Improvements This update includes new features and quality improvements that were part of the following update: May 12, 2026—KB5089549 (OS Builds 26200.8457 and 26100.8457) May 26, 2026—KB5089573 (OS Builds 26200.8524 and 26100.8524) This update addresses security vulnerabilities documented in the following guide: June 2026 Security Updates. The following summary outlines key quality ...
2026-06-19 02:31 UTC -
web:www.computerworld.com
Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...
2026-06-19 02:31 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.
2026-06-19 02:31 UTC -
web:www.malwarebytes.com
Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.
2026-06-19 02:31 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-06-19 02:31 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.