Open-Xchange Dovecot Security Advisory: Multiple Vulnerabilities (CVE-2026-27851, 48016, 33603, 48028, 48029, 48030)

Open-Xchange Dovecot Security Vulnerability Summary Vulnerability Overview Multiple security vulnerabilities exist in Open-Xchange Dovecot, including: 1. CVE-2026-27851: The security filter uses variable expansion, causing all strings in the pipeline to be incorrectly interpreted as secure, enabling unescaped unsafe data. 2. CVE-2026-48016: An attacker can upload malicious Sieve scripts via the ManageSieve service (or locally) to bypass the configured CPU time limit, up to 130 times the configured limit. 3. CVE-2026-33603: bypasses the Sieve limit (130+ overflow). 4. CVE-2026-48028: An attacker can forge SCRAM TLS channel binding between Dovecot and clients using a crafted base64 exchange, requiring the attacker to position themselves between the Dovecot and client connections. 5. CVE-2026-48029: Login Base64 input can contain tags that bypass IPC protection. 6. CVE-2026-48030: An attacker can use the IMAP SETACL command to inject permissions into a user's file, even if . This results in folders being spammed to all users. Affected Versions OX Dovecot Pro 3.1.4 OX Dovecot Pro 3.1.5 OX Dovecot Pro 2.3.0 OX Dovecot Pro 3.1.0 OX Dovecot Pro 3.0.5 OX Dovecot CE 2.4.3 OX Dovecot CE 2.4.4 OX Dovecot CE 2.4.0 Remediation Install fixed versions: - OX Dovecot Pro 3.1.5 - OX Dovecot CE 2.4.4 Avoid using the security filter: Avoid using the security filter until the fixed version is available. Install fixed versions or prevent direct access to Sieve scripts: Via ManageSieve or local access. Prevent direct access to Sieve scripts: Via ManageSieve or local access. POC or Exploit Code No specific POC or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Open-Xchange Dovecot Security Advisory: Multiple Vulnerabilities (CVE-2026-27851, 48016, 33603, 48028, 48029, 48030)