CVE-2026-27856 Information disclosure in OX Dovecot Pro
Attackers can exploit a timing oracle in Doveadm credential verification to discover credentials and gain full access to the mail server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27856?
CVE-2026-27856 is a high-severity vulnerability in Dovecot Dovecot, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
Which versions are affected by CVE-2026-27856?
It affects 2 products.
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-27856?
Upgrade to a fixed version.
Is CVE-2026-27856 being exploited?
There is no known exploitation of CVE-2026-27856 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-27856, AZL-81704, DEBIAN-CVE-2026-27856, GHSA-mv3x-9fw3-qf38, UBUNTU-CVE-2026-27856.