WhatBrokeToday
Today's Trends
criticalInvestigatingApachevprior to version 3.9.1

Apache James server: CVE-2026-76168 (Critical)

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

Apache James server prior to version 3.9.1 is vulnerable to a critical path traversal vulnerability, allowing attackers to set arbitrary SIEVE scripts for other users, leading to denial of service or traffic capture. Users are recommended to upgrade to version 3.9.1.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorrect validation of file paths can result in path transversal allowing attackers to set arbitrary SIEVE scripts for other users.

Evidence

2 reports · 2 CVEShow
  1. [1]
    CVE First report
    Apache James server: CVE-2026-76168 (Critical)(opens security advisory in a new tab)

    Critical severity. In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

    by Tenable 0upvotes 0comments

  2. [2]
    CVE
    Apache James server: CVE-2026-76171 (Critical)(opens security advisory in a new tab)

    Critical severity. In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

    by Tenable 0upvotes 0comments94% match

Timeline

  1. First report on security advisory

    Apache James server: CVE-2026-76168 (Critical)

    Source