CVE-2026-33603
CVE-2026-33603
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.8EPSS 0.2%KEV nãoPoC —Patch referenciado
Lifecycle
May 12, 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Open-Xchange GmbH · OX Dovecot ProWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →