ActFax vulnerabilities

Products

• ActFax 2
• ActiveFax Server 1
• Server 1

Latest ActFax CVEs

Newest publication first

1. CVE-2019-25310 ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path

   Published 2026-02-11

   High·CVSS 8.5 EPSS 0.14%

   ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launch...

2. CVE-2023-53954 ActFax 10.10 Unquoted Path Services Privilege Escalation Vulnerability

   Published 2025-12-19

   High·CVSS 8.5 EPSS 0.14%

   ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceNT service configuration. Attackers with write permissions to Program Files directories can inject a malicious ActSrvNT.ex...

3. CVE-2012-10043 ActFax 4.32 Client Importer Buffer Overflow

   Published 2025-08-08

   Critical·CVSS 9.3 EPSS 0.48% Framework module

   A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usa...

4. CVE-2020-15843 ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client, %PROGRAMFILES%\ActiveFax\Insta...

   Published 2020-09-24

   High·CVSS 7.3 EPSS 0.40%

   ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal. The folder permissions allow "Full Co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.