Does a CVE affect MetaDefender Email Gateway Security?

CVE-2024-4577

CVE-2024-4577 is about PHP and MetaDefender Email Gateway Security are not using PHP so the system is not impacted

CVE-2024-38819

MetaDefender Email Gateway Security doesn't use Spring so it's not affected by this CVE

CVE-2018-15133

MetaDefender Email Gateway Security doesn't use PHP in the product so it's not affected

CVE-2024-10979

MetaDefender Email Gateway Security doesn't use PostgreSQL, therefore is not effected by this CVE.

CVE-2025-21298

MetaDefender Email Gateway Security does not engage in the processing of RTF bodies or attachments. As a result, this vulnerability has no impact on the product.

CVE-2025-4211

This is a Qt vulnerability that Black Duck flagged (BDSA-2025-4298). It was remediated in EGS 6.3.0 by upgrading Qt to a release that contains the fix.

CVE-2025-49146

This is about the PostgreSQL JDBC driver (pgjdbc). pgjdbc is not used in EGS and is not installed by the EGS installer, so EGS is not affected.

CVE-2025-66376

This is a Zimbra stored XSS. EGS uses its own SMTP server and a .NET mail agent, not Zimbra, so it is not affected.

CVE-2025-68686

This is a Fortinet FortiOS issue. EGS contains no Fortinet software, so it is not affected.

CVE-2026-4800

This is a Lodash prototype pollution. EGS never passed attacker-controlled input to the affected functions, and lodash was upgraded to 4.18.1 in EGS 6.4.0.

CVE-2026-6732

This is a libxml2 crash in XSD schema validation. EGS uses libxml2 only for SAML parsing and never calls schema validation, so the vulnerable code is not reachable.

CVE-2026-11979

This affects only libxml2’s xmlcatalog command-line utility. EGS ships libxml2.dll but not the utility, so it is not affected.

CVE-2026-42945

This is an nginx rewrite module overflow. No EGS rewrite rule uses “?” in its replacement string, so the vulnerable path is not reachable.

CVE-2026-42533

This is an nginx overflow that needs a regex map directive. The EGS nginx configuration contains no map directive, so it is not reachable.

CVE-2026-56434

This is an nginx SSI use-after-free that needs ssi, proxy_pass and proxy_buffering off together. EGS configures none of them and has no reverse-proxy path, so it is not reachable.

CVE-2026-60005

This affects the nginx slice module. That module is not compiled into the nginx shipped with EGS, so EGS is not affected.

CVE-2026-44503

This is a Microsoft Kiota RedirectHandler header leak. Kiota is present only as a dependency of the M365 integration, and EGS never loads the vulnerable handler, so it is not affected.

CVE-2026-33630

This is a c-ares use-after-free. The c-ares version shipped with EGS (1.19.1) predates the vulnerable code, so EGS is not affected.

CVE-2026-14266

This is a 7-Zip XZ decoder overflow. EGS uses 7-Zip only to compress logs and support bundles and never to decode untrusted input, so it is not affected.

CVE-2026-45491

This is a .NET tar extraction path traversal. EGS does not extract tar archives, so it is not affected.

CVE-2026-45490

This is a .NET SDK privilege escalation. The SDK is a build-environment component and is not shipped with EGS, so it is not affected.

CVE-2026-45249

This is an ECharts XSS in the “lines” series tooltip. EGS dashboards use only line and pie charts, so the vulnerable code does not run.

CVE-2026-54570

This is an AngleSharp mutation XSS. The EGS SVG sanitizer allows no math or annotation-xml elements and removes disallowed elements with their children, so it is not affected.

CVE-2026-16413

This is a Google Chrome vulnerability. EGS bundles no Chromium engine, and the admin UI runs in the user’s own browser, so it is not affected.

CVE-2026-50522

This is a Microsoft SharePoint deserialization RCE. EGS contains no SharePoint code or dependency, so it is not affected.