CVE-2002-2086: Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote...

Security readout for executives and security teams

CVE-2002-2086 is an old SquirrelMail webmail XSS issue. Versions before 1.2.6 could render attacker-supplied script or HTML through magicHTML filtering weaknesses. In business terms, a remaining legacy SquirrelMail deployment could expose user browser sessions and webmail data if malicious content is viewed. Exposure is most likely in legacy environments still running SquirrelMail before 1.2.6, or systems carrying the same magicHTML code path. Modern environments are unlikely to be affected unless this obsolete webmail stack remains deployed. Treat this as a legacy hygiene issue unless SquirrelMail before 1.2.6 is still present. If found, prioritize remediation because webmail XSS can affect user trust, account confidentiality, and internal communications. Mitigation focus: Inventory any SquirrelMail deployments and confirm exact version.; Upgrade SquirrelMail instances older than 1.2.6 using vendor guidance.; Decommission obsolete SquirrelMail systems where upgrade is not practical..

Prepared

Jun 29, 2026, 19:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.