CVE-2026-27851
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | ≤ 3.1.4 | affected |
≤ 2.4.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-27851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对额外参数处理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Open-Xchange OX Dovecot Pro 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open-Xchange OX Dovecot Pro是德国Open-Xchange公司的一个邮件存储与投递系统。 Open-Xchange OX Dovecot Pro存在安全漏洞，该漏洞源于使用安全过滤器进行变量扩展时，同一字符串上的所有后续管道被错误地视为安全，导致不安全数据被取消转义，可能在身份验证中启用SQL或LDAP注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 ~ 3.1.4 | - |
II. Public POCs for CVE-2026-27851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27851
请登录查看更多情报信息。
Same Patch Batch · Open-Xchange GmbH · 2026-05-12 · 5 CVEs total
| CVE-2026-33603 | 6.8 MEDIUM | Open-Xchange OX Dovecot Pro 安全漏洞 |
| CVE-2026-40016 | 5.3 MEDIUM | Open-Xchange OX Dovecot Pro 资源管理错误漏洞 |
| CVE-2026-42006 | 4.3 MEDIUM | Open-Xchange OX Dovecot Pro 资源管理错误漏洞 |
| CVE-2026-40020 | 3.1 LOW | Open-Xchange OX Dovecot Pro 访问控制错误漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-27851
No comments yet