CVE-2026-35391 Bulwarkmail CVE debrief

Who should care

Administrators and users of Bulwark Webmail, especially those who have not upgraded to version 1.4.11, should be aware of this vulnerability and take necessary precautions to protect their systems. This includes reviewing system configurations, monitoring for suspicious activity, and prioritizing upgrades to version 1.4.11 or later. Vulnerability management and security teams should also review and update IP-based rate limiting configurations and monitor audit logs for potential exploitation attempts.

Technical summary

The getClientIP() function in Bulwark Webmail's lib/admin/session.ts file was vulnerable to IP address spoofing. An attacker could manipulate the X-Forwarded-For header to bypass IP-based rate limiting or forge audit log entries. This vulnerability has been fixed in version 1.4.11. Affected systems should prioritize upgrading to this version or later. Technical details are based on CVE and NVD data.

Defensive priority

High

Recommended defensive actions

• Upgrade to Bulwark Webmail version 1.4.11 or later
• Review and update IP-based rate limiting configurations
• Monitor for suspicious activity in audit logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-06T21:16:20.867Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify system configurations and review logs for potential exploitation attempts within the known affected scope.

Official resources