Security incident impacts GravityZone Extended Email Security
Date: 2026.10.21
Bitdefender identified unauthorized access that impacted a limited number of customers using GravityZone Extended Email Security or the Mesh Email Security platform. The previously unknown vulnerability exploited in this incident has been fixed, and unauthorized access has been stopped. Bitdefender has deployed a security patch across all production environments and implemented additional safeguards.
We are notifying affected customers through their established service and support channels, providing information specific to their environments and the actions taken.
This page outlines our findings to date, impact, and remediation measures. Our investigation remains ongoing, and we will update this page if additional information is confirmed.
We sincerely appreciate your patience and understanding as we continue our investigation of this incident.
Frequently Asked Questions (FAQ)
What happened?
On October 17, 2026, an unauthorized party used a self-service trial account, obtained through Bitdefender’s public free-trial form, to exploit a previously unknown vulnerability in a function used to import users in GravityZone Extended Email Security and Mesh Email security platform. This allowed the unauthorized party to create unauthorized user accounts and extend its access to customer tenants. Bitdefender detected suspect activity and started investigating on October 19, 2026.
Who was affected?
A limited number of customers using GravityZone Extended Email Security or the Mesh Email security platform from Mesh, a Bitdefender company, were affected. Bitdefender has notified affected customers directly.
What was the impact?
The information potentially accessed by the attacker includes usernames, email addresses, IP addresses, account information, custom email filtering rules, and email log metadata. Bitdefender is treating this as a potential data exposure incident.
Email messages or attachment content were not affected, as the service does not store email bodies.
Bitdefender is communicating directly with affected customers to provide details specific to their organizations, including the nature and extent of any identified impact.
Was endpoint protection affected?
The email security solution operates independently of our endpoint security products, with separate infrastructure and functionality. The incident was isolated to a small portion of the email security environment and did not affect our endpoint security products or their functionality.
Has the issue been resolved?
Yes. Bitdefender cut off the unauthorized party’s access and deployed a patch across the email security environment. Our investigation continues, and we will update this page if new information becomes available.
What actions has Bitdefender taken?
Bitdefender acted immediately upon identifying the incident. We cut off the unauthorized party’s access and disabled the malicious accounts, API keys, and tenants. We restricted access to the vulnerable functionality, removed the trial product from self-service, and deployed a patch across all production environments that eliminated the vulnerability. Bitdefender is also completing its analysis of the full sequence of events and assessing its regulatory notification obligations in consultation with its Privacy and Legal teams.
How do I know if my organization was affected?
Bitdefender has notified affected customers directly, in line with our data processing agreements. If you are a user of GravityZone Extended Email Security or the Mesh Email Security Platform and have not been contacted but want to discuss, please contact us at b2bsupport@bitdefender.com for assistance.
What steps can I take to mitigate any risks?
Unless you have been contacted by Bitdefender, no action is required from your side. As a good security practice, we recommend that administrators regularly review user accounts, API keys, and role and email security configuration settings for unexpected changes, and remain cautious of suspicious emails. If you notice any unexpected changes or suspicious activity, please contact our Technical Support team.
What is Bitdefender doing to ensure this does not happen again?
The previously unknown vulnerability was fixed. In parallel with the ongoing investigation, Bitdefender is reviewing the controls around trial access and the affected functionality. Once the investigation is finalized and findings are fully assessed, Bitdefender will implement appropriate measures to strengthen its processes and safeguards.
Whom can I contact if I have additional questions or concerns?
If you have further questions or need assistance, please contact our Technical Support team at b2bsupport@bitdefender.com, and we will be happy to help.