External risk intelligence

Apache James JMAP WebPush SSRF Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-76171

Apache James is a mail and application server typically deployed to provide internet-facing email and messaging services. As a server product, its components, including JMAP interfaces, are commonly exposed to the internet to facilitate client connectivity, making them reachable in standard deployment patterns.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in the Apache James server could allow unauthorized access to internal network resources. This issue, discovered in versions prior to 3.9.1, arises from improper validation within the JMAP webPush feature, potentially enabling attackers to reach internal addresses. The primary concern at this stage is to confirm if this specific technology is in use and exposed.

Server vulnerability could expose internal addresses.
Matters if Apache James is used for external services.
Confirm relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the JMAP interface of an Apache James server. This could allow them to access internal network addresses that should not be publicly reachable, potentially leading to unauthorized data exposure or system compromise.

Entry condition: Unauthenticated access to the JMAP interface.
Trigger point: Sending requests with improper validation.
Resulting risk: Exposure of internal network addresses.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Apache James server's JMAP webPush functionality could allow an attacker to send requests to internal network addresses. This could occur when the server is configured to process JMAP requests and the specific webPush feature is utilized without proper validation of the target addresses.

Internal network addresses could be reached.
Via specially crafted JMAP webPush requests.
Service disruption or information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache James server impacts the JMAP webPush validation and could allow access to internal addresses. Infrastructure or platform teams responsible for the James server deployment should take the lead, coordinating with security teams to assess exposure. The initial practical step involves identifying all instances of the affected server, determining their reachability and business criticality, and locating the accountable owner to plan remediation.

Server owners should address the vulnerability.
Verify all James server instances and their exposure.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache James?

Apache James is an open-source enterprise mail and application server written in Java. It provides protocols like SMTP, IMAP, and JMAP to handle email and messaging services. Organizations use it to host private mail infrastructures or as a backend platform for messaging applications. Because it manages communications, it is frequently deployed to be reachable over a network, allowing clients to send, receive, and manage their data through these integrated interfaces.

What does CVE-2026-76171 mean for the server?

This vulnerability is classified as CWE-918, or Server-Side Request Forgery (SSRF). In plain terms, it means the server can be tricked into acting as a proxy to send requests to destinations it was not intended to visit. Because of improper validation in the JMAP webPush feature, an attacker can manipulate the server to connect to internal network addresses that are otherwise hidden from the public, potentially bypassing security boundaries.

How is this SSRF vulnerability triggered?

An attacker triggers this by sending specially crafted JMAP webPush requests to the server's JMAP interface. The vulnerability relies on the server failing to properly validate the target addresses within those requests. Simply having the server installed is not enough; the JMAP interface must be active, and the specific webPush functionality must be capable of processing the malicious input to initiate unauthorized outbound connections.

Why should I care about CVE-2026-76171?

You should care if you manage Apache James deployments. According to Halo Surface Signal, this software is typically configured to provide internet-facing services, meaning these interfaces are often reachable by external parties. If your server is exposed to the internet, it provides a potential path for an attacker to probe your internal network, reaching services or resources that are meant to remain isolated from the public.

Is there a first step to handle this?

The most important first step is to inventory your environment to locate all running instances of Apache James. Once identified, verify which servers are reachable from external networks and confirm if the JMAP interface is in use. Determine the business criticality of these assets and coordinate with the relevant technical teams to plan an upgrade to version 3.9.1, which includes the necessary validation logic to prevent these unauthorized requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.