CVE-2026-100389 GestSup CVE debrief

Who should care

System administrators and security teams responsible for GestSup installations should assess exposure and apply patches or mitigations. This includes reviewing current GestSup versions, understanding the vulnerability's impact on their specific deployments, and taking appropriate actions to prevent exploitation. Additionally, security teams should verify that monitoring and detection mechanisms are in place to identify potential suspicious activity related

Why it matters

CVE-2026-100389 is a critical remote code execution vulnerability in GestSup versions before 3.2.61, allowing unauthenticated attackers to execute arbitrary code by sending emails with malicious attachments.

• Unauthenticated attackers can execute arbitrary code
• Potential for lateral movement and further exploitation
• Requires immediate attention to prevent exploitation
• Verification of GestSup version and patch level is necessary

Technical summary

The vulnerability exists in the basic IMAP connector's attachment handling in GestSup versions before 3.2.61. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed. This allows for arbitrary code execution, posing a critical risk to GestSup installations. Immediate attention is required to assess exposure and apply patches or mitigations. The vulnerability's impact includes potential lateral movement and further exploitation, emphasizing the need for prompt verification of GestSup version and patch level.

Defensive priority

Immediate attention is required to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if GestSup versions before 3.2.61 are in use
• Apply patches or updates to GestSup to version 3.2.61 or later
• Restrict access to the upload/ticket directory
• Monitor for suspicious email activity and attachments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GestSup versions before 3.2.61, but additional information on affected versions, remediation, and verification steps for defenders is limited. Further review of GestSup documentation and security advisories is recommended to understand the full scope of the vulnerability and necessary mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.