Platform
other
Component
icewarp
Fixed in
14.2.1
CVE-2026-2493 is a directory traversal vulnerability discovered in IceWarp, a collaboration platform. This flaw allows unauthenticated remote attackers to disclose sensitive information by manipulating the 'ticket' parameter in the collaboration endpoint. The vulnerability impacts IceWarp versions 14.2.0.10 through 14.2.0.10. A fix is available from the vendor.
Successful exploitation of CVE-2026-2493 allows an attacker to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, user credentials, or internal documents. The lack of authentication requirements significantly broadens the attack surface, making it easier for malicious actors to exploit the vulnerability. This could lead to data breaches, unauthorized access to systems, and potential compromise of the entire IceWarp environment. The vulnerability's impact is amplified by the potential for root-level access, allowing attackers to escalate privileges and further compromise the system.
CVE-2026-2493 was publicly disclosed on 2026-03-13. The vulnerability was reported to ZDI (Zero Day Initiative) as ZDI-CAN-25440. The vulnerability's ease of exploitation, combined with the lack of authentication requirements, suggests a medium probability of exploitation. Public proof-of-concept (PoC) code may become available, increasing the risk of widespread exploitation.
Exploit Status
EPSS
15.24% (95% percentile)
CISA SSVC
The primary mitigation for CVE-2026-2493 is to upgrade to a patched version of IceWarp as soon as it becomes available. Until the upgrade can be performed, consider implementing temporary workarounds such as restricting access to the collaboration endpoint through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests containing suspicious characters or patterns in the 'ticket' parameter. Thoroughly review IceWarp's configuration to ensure that file system permissions are properly restricted and that sensitive data is not stored in publicly accessible locations. After upgrade, confirm the vulnerability is resolved by attempting to access a restricted file via the collaboration endpoint and verifying that access is denied.
Update IceWarp to a version later than 14.2.0.10 to correct the directory traversal vulnerability. Consult the vendor's website for the latest version and update instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-2493 is a Directory Traversal vulnerability in IceWarp allowing attackers to disclose sensitive information without authentication.
You are affected if you are running IceWarp versions 14.2.0.10 through 14.2.0.10. Upgrade to a patched version as soon as possible.
Upgrade to a patched version of IceWarp. Until then, implement WAF rules to restrict access to the collaboration endpoint.
While active exploitation is not confirmed, the vulnerability's ease of exploitation suggests a medium probability of exploitation.
Refer to the official IceWarp security advisory for details and updates regarding CVE-2026-2493.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.