CVE-2026-70408: acmailer Flaw Lets Staff Accounts Become Admins

Two vulnerabilities have been disclosed in acmailer, a free, self-hosted mail delivery CGI that has long been a fixture on Japanese rental web hosting. JPCERT/CC and IPA published them as JVN#47716829 on August 19, 2026, and the more serious of the two, CVE-2026-70408, carries a severity score of 8.8. It allows a deliberately restricted staff account to create an account with full administrator privileges.

The fixes ship in acmailer CGI ver.4.1.2 and acmailer DB ver.1.2.2, which the developer, Extra Innovation Inc., released back on July 27, 2026. That release note, however, is two lines long under the heading "version update contents," and it mentions neither the word "vulnerability" nor the JVN number. It gives users no way to gauge the risk, so this article fills in the gap.

There is a second reason to pay attention. acmailer is a product that has been hit by a steady run of intrusions since the summer of 2023, prompting repeated warnings from the Kyoto, Shiga, Fukui, Osaka and Ibaraki Prefectural Police. In most of those cases the software was no longer in use — it had simply been left sitting on the server. If you have stopped using acmailer, this article is even more relevant to you.

Two flaws, and the serious one turns a staff account into an administrator

acmailer has a sub-account feature designed to delegate nothing more than the work of sending mail — the "you handle the sends, but don't touch the settings" arrangement. CVE-2026-70408 means the holder of such a sub-account can create a different sub-account that does carry administrative privileges. JVN phrases it as "a sub-account with administrative privileges may be created by a sub-account user."

This is the class of flaw known as privilege escalation: the person you handed a narrow set of permissions to can widen that set themselves. For any organisation that has issued accounts to contractors, temporary staff or part-timers who have since left, the assumption that "they can't see that any more" no longer holds. A score of 8.8 is high for a flaw that requires the attacker to be logged in first.

The other issue, CVE-2026-66358, is cross-site scripting: plant a crafted string and it executes as attacker-supplied code in the browser of whoever opens the affected screen. Get an administrator to trigger it and their logged-in session can be hijacked. On its own it rates 6.1, but chained with the privilege escalation above it becomes considerably more useful to an attacker.

Both issues landed on NVD, the US vulnerability database, on August 19, 2026 — the same day they appeared on JVN and JVNDB-2026-000118. JPCERT/CC filed the records, citing JVN and the vendor notice as references, and the severity figures match JVN (8.8 for CVE-2026-70408, 6.1 for CVE-2026-66358).

So searching by CVE number now returns something. That is not the same as being covered, though. Tooling that spots vulnerable software by CVE number assumes the software arrived through a package manager. acmailer is dropped onto a rented web host by hand, so it usually falls outside that tooling entirely. You still have to go and look at your own server. The next section is how.

Who targets it, and why

The attackers going after acmailer have been the kind who use search engines to mechanically compile lists of sites running it. This is not sophisticated state-linked activity; it is volume work aimed at acquiring relay points. In its 2023 advisory, the Shiga Prefectural Police wrote that its investigation revealed "a pattern in which administrator privileges on acmailer are obtained and the system is then used as a springboard for cybercrime."

What they do with it is use the hijacked mail delivery function to blast out fraudulent messages in the site's own name. Because the mail arrives from the same sender that normally delivers the newsletter, recipients have no reason to be suspicious. At the same time, the attackers download the subscriber list in bulk. In some cases they also rewrote the site's own files to display different content, or dropped malicious programs on the server.

The damage splits two ways. Subscribers have their names and email addresses — and sometimes their postal addresses and ages — exposed, making them targets for later scam mail and harassment. The organisation running the site ends up apologising for the leak while also being treated as the origin of a fraudulent mail campaign sent from its own domain. When an unauthorised login happens on the hosting provider's side, you can at least wait for the provider's statement. acmailer is software you installed yourself, so both the responsibility and the response rest entirely with you.

What acmailer is, and why so many Japanese sites run it

acmailer is software for sending newsletters and bulk mail under your own steam. Rather than subscribing to an external service, you install and run it inside the rental hosting account you already pay for — the official site pitches it as an "independent delivery type that installs the system on your own website" with "no advertising inserted whatsoever." It was originally developed by 株式会社シーズ (Seeds), and the business transferred to Extra Innovation Inc. in August 2021. The product has been in use for close to twenty years.

Why it spread is no mystery. It is free, feature-rich, and works as soon as you drop it in place. It found its way into small and mid-sized businesses, sole traders, NPOs, public facilities, and the sites that web agencies operate on behalf of clients. There are no official adoption figures, but Sakura Internet noted in its advisory that "acmailer is not offered through Quick Install on Sakura's rental server and we do not guarantee its operation; nevertheless, we have confirmed that a large number of our customers use it." In other words, usage was widespread enough that the host felt compelled to publish a notice about a product it does not even support.

That difference in the "how you update" column has translated directly into a difference in who gets breached. The free CGI edition cannot be updated in place; you have to install it fresh into a new folder. Because that takes effort, it gets postponed — and then forgotten. The paid DB edition updates from a single button in the admin screen, so missed updates are rare. The situation we have now, where a fix exists but huge numbers of installs never receive it, is a direct consequence of that design.

Checking whether it is on your server

The most dangerous position is "we used it at some point, but I have no idea what state it is in now." Sakura Internet publishes a usefully concrete checking procedure, so the steps below follow it. The same logic applies on any other host.

1. Look for the folder. The acmailer installation guide directs you to install into /acmailer, so start by checking whether a folder with that name exists in your public web area. FTP client or file manager, either is fine. The folder can be renamed freely, so if you do not find it, search the whole server for the filenames below.

2. Check the version. Open lib/setup.cgi inside the installation folder and find the line containing $SYS->{version}. The number there is the version you are actually running. Anything below 4.1.2 on the CGI edition, or below 1.2.2 on the DB edition, is affected.

3. Sometimes you can spot it from outside. Newsletter signup forms often carry the line "powered by メール配信CGI acmailer" beneath them, because that attribution is a condition of the free licence. It is also the marker outside researchers have long used to identify sites running it. Open your own signup form and take a look.

4. Check for files from removed features. Look for leftovers from the survey feature that caused the 2021 vulnerabilities (enq_detail.cgi, enq_edit.cgi and similar). That feature was removed in ver.4.0.3 in January 2021, so if the files are still there, your install has been frozen in place for a very long time.

The biggest risk is the install nobody uses any more

Line up the publicly disclosed breaches and a common thread emerges immediately.

The Chiba Prefectural Kimitsu Kameyama Youth Nature House was breached in December 2023, and 613 subscriber email addresses were downloaded as a CSV file. According to Nikkei xTECH, the newsletter in question had stopped publishing on February 1 of that same year, yet the system remained on the server, still capable of sending. The data was taken ten months after the service was retired.

The Japan Developmental Disorder Association (JDDA) noticed a breach in September 2023 after a series of inappropriate emails reached its subscribers, and disclosed in 2024 that the names and email addresses of roughly 800 people had been leaked. It cited CVE-2021-20617 and CVE-2021-20618 from 2021 as the cause. The leaked information was published online, and the association reported that harassment of those affected continued afterwards.

The pattern carried into 2025. At Hiroshi Project, a malicious program was planted in the acmailer folder, the blog's front page was defaced, and the names, genders, ages, email addresses and postal addresses of roughly 260 subscribers were leaked (reported by ScanNetSecurity). Around the same time Asahi Homes disclosed a web server defacement and the leak of 141 email addresses, stating explicitly in its cause section that "a vulnerability in the mail delivery CGI 'acmailer' may have been exploited."

The Osaka Prefectural Police summed the pattern up in an advisory headlined "Never leave a mail delivery system unattended!", noting cases where organisations were breached because they had used the software in the past and never deleted it. Sakura Internet is equally direct: "If you are no longer using acmailer and only the installed files remain, please delete them as well."

In October 2025 the Ibaraki Prefectural Police headquarters used its official account to urge people to "delete it if you don't need it." If you have no plans to keep it updated, deletion — not updating — is the right answer. Delete the subscriber list files along with it.

Police advisories since 2023, which is highly unusual

It is rare for several prefectural police forces to independently issue warnings about a single piece of software. Here is how acmailer got there.

The line worth dwelling on is this: a hole patched in March 2021 was not disclosed on JVN (as CVE-2021-46686, severity 9.8) until February 2025. The fix had been available for years, but it took four years for the flaw to be catalogued and made public. Throughout that window, an un-updated install was not "safe because there was no information" — it was "in danger, with no information." The surge of breaches in the summer of 2023 happened squarely inside that gap.

The current round looks much the same. The fixed versions appeared on July 27; the JVN disclosure came on August 19, a gap of about three weeks — and the developer's own announcement never uses the word "vulnerability." Check the US government's catalogue of vulnerabilities known to be exploited in the wild (KEV) and you will find not a single acmailer entry as of the August 18, 2026 revision. Police in Japan have publicly confirmed active exploitation, yet the product does not exist on the international list. It is a neat illustration of how poorly vulnerability information about Japanese domestic software travels into global systems.

What to do right now

What you should do depends on whether you are still using it.

If you are using it, update. On acmailer DB you can upgrade from a button in the admin screen. The free CGI edition requires a reinstall: back up your settings and subscriber list, download the latest installer from the official site, install into a new folder, and after running it delete install.cgi and init_ctl.cgi. Forget to remove those two files and they remain as the entry point for the 2021 vulnerabilities.

If you are not using it, delete it. Remove the entire folder, and the subscriber list files with it. Keeping it around because "we might restart it some day" is the single pattern that has produced the most breaches so far. If you do restart, you can install it again then.

If you have handed out sub-accounts, audit them. This flaw lets anyone holding a low-privilege account create an administrator. Review the list of currently active accounts and check whether any administrative account was created before you updated. If a contractor's or former employee's account is still live, that is where you stop.

Check whether you have already been breached. Look for sends you do not recognise in the newsletter delivery history, signs that the subscriber list was downloaded, and files on the site that have been altered. Every past breach came to light the same way: a subscriber got in touch to say they had received a suspicious email. Waiting for that call is too late — go and look for yourself.

More fundamentally, there is the option of not self-hosting at all. Self-installed software buys flexibility at the cost of putting the entire update burden on whoever installed it. If your organisation has no structure for maintaining a twenty-year-old system indefinitely, moving to an external mail delivery service will usually work out cheaper in the end.

Summary

Of the two vulnerabilities disclosed in acmailer, CVE-2026-70408 is a privilege escalation rated 8.8. Because an account issued for delivery work alone can be used to create an administrator, the organisations most affected are those running the system with several people involved. The fixes are acmailer CGI ver.4.1.2 and acmailer DB ver.1.2.2, available since July 27, 2026.

That said, what has actually caused harm with this product is not so much any individual new vulnerability as the acmailer installs left in place and never updated. The leaks of 613, 800, 260 and 141 records all trace back to exactly that. What to do today is simple: check whether /acmailer exists on your server, and if it does, decide between upgrading to the latest version and deleting it outright because you no longer use it.

Sources

• ▸JVN#47716829 - Multiple vulnerabilities in acmailer (August 19, 2026)
• ▸JVNDB-2026-000118 (August 19, 2026)
• ▸NVD - CVE-2026-70408 (published August 19, 2026; CVSS 8.8)
• ▸NVD - CVE-2026-66358 (published August 19, 2026; CVSS 6.1)
• ▸acmailer official - acmailer CGI ver.4.1.2 and acmailer DB ver.1.2.2 version update contents (July 27, 2026)
• ▸Sakura Internet - [Reissued] Please be aware of the acmailer vulnerabilities (first published September 6, 2023 / reissued March 31, 2025)
• ▸JVN#35906450 - Multiple vulnerabilities in acmailer (January 14, 2021; CVE-2021-20617 / 20618)
• ▸JVN#96957439 - OS command injection vulnerability in acmailer (February 14, 2025; CVE-2021-46686)
• ▸JVN#84319378 - Cross-site scripting vulnerability in acmailer (February 12, 2025; CVE-2023-49780)
• ▸Osaka Prefectural Police - Cybersecurity bulletin: "Never leave a mail delivery system unattended!"
• ▸Ibaraki Prefectural Police headquarters - Advisory on the acmailer vulnerabilities (October 29, 2025)
• ▸Fukui Prefectural Police - Advisory on intrusions exploiting the acmailer vulnerabilities (August 7, 2023)
• ▸Nikkei xTECH - Newsletter breach at the Chiba Prefectural Kimitsu Kameyama Youth Nature House
• ▸ScanNetSecurity - Unauthorised access to the Hiroshi Project website (March 10, 2025)
• ▸ScanNetSecurity - Advisory on intrusions exploiting the acmailer vulnerabilities (September 6, 2023)
• ▸acmailer official - acmailer DB