Log in Start free

Vulnerability · Published Mar 27, 2026 · Assigned by OX

CVE-2026-27856

High 7.4

In plain English

A high-severity improper authentication in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 65.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23dovecot2.4.3-r0ALPINE-CVE-2026-27856
Alpine:v3.24dovecot2.4.3-r0ALPINE-CVE-2026-27856
Debian:12dovecot1:2.3.19.1+dfsg1-2.1+deb12u2DEBIAN-CVE-2026-27856
Debian:13dovecot1:2.4.1+dfsg1-6+deb13u4DEBIAN-CVE-2026-27856
Debian:14dovecot1:2.4.3+dfsg1-1DEBIAN-CVE-2026-27856
Ubuntu:22.04:LTSdovecot1:2.3.16+dfsg1-3ubuntu2.7UBUNTU-CVE-2026-27856
Ubuntu:24.04:LTSdovecot1:2.3.21+dfsg1-2ubuntu6.3UBUNTU-CVE-2026-27856
Ubuntu:25.10dovecot1:2.4.1+dfsg1-5ubuntu4.1UBUNTU-CVE-2026-27856

Affected products (as reported)

VendorProductVersions
Open-Xchange GmbH OX Dovecot Pro 0 – through 2.3.0

Weakness: CWE-287, CWE-208 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References