GFI Software vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-74237 GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality.High 7.1 · Sep 4, 2026
• CVE-2026-74236 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler.High 7 · Sep 4, 2026
• CVE-2026-2039 GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability.Critical 9.8 · Feb 20, 2026
• CVE-2026-2038 GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability.Critical 9.8 · Feb 20, 2026
• CVE-2026-2037 GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 8.8 · Feb 20, 2026
• CVE-2026-2036 GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 8.8 · Feb 20, 2026
• CVE-2025-34071 A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the fiCritical 9.4 · Jul 2, 2025
• CVE-2025-34070 A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operatCritical 10 · Jul 2, 2025
• CVE-2025-34069 An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent serCritical 9.5 · Jul 2, 2025
• CVE-2025-35940 The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key.High 8.1 · Jun 10, 2025
• CVE-2025-34491 GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue.High 8.8 · Apr 28, 2025
• CVE-2025-34489 GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue.High 7.8 · Apr 28, 2025
• CVE-2024-52875 An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.High 8.8 · Jan 31, 2025
• CVE-2024-11949 GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 8.8 · Dec 11, 2024
• CVE-2024-11948 GFI Archiver Telerik Web UI Remote Code Execution Vulnerability.Critical 9.8 · Dec 11, 2024
• CVE-2024-11947 GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.High 8.8 · Dec 11, 2024
• CVE-2023-25267 An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0).High 8.8 · Mar 15, 2023
• CVE-2021-29281 File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2Critical 9.8 · Jul 7, 2022
• CVE-2010-5181 Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would oHigh 7 · Aug 25, 2012
• CVE-2005-3182 Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers such as (1) Host anHigh 7.5 · Oct 20, 2005
• CVE-2004-1312 A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service vHigh 10 · Jan 3, 2005
• CVE-2002-1121 SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configHigh 7.5 · Sep 24, 2002