Ox Dovecot Pro CVE-2026-27855

CVSS 6.8 indicates high impact (C:H, I:H, A:N) but AC:H and UI:R constrain real-world exploitability. Attack Vector is Network, meaning remote exploitation is possible, but the high attack complexity-requiring auth cache enablement, passdb username modification, and observation of an OTP exchange-significantly narrows the attack surface. EPSS data is not provided in the intelligence input, preventing correlation with empirical exploitation probability. No CISA KEV (Known Exploited Vulnerability) status is indicated, and no public proof-of-concept code is referenced, suggesting active exploitation in the wild is not documented. SSVC framework assessment: exploitation status is unconfirmed (not actively weaponized); the technical impact is high (authentication bypass); automatable impact is moderate (requires network visibility and cache configuration knowledge). Risk priority is moderate within organizations running Open-XChange Dovecot Pro with auth cache enabled and custom passdb username transformations. Organizations with default Dovecot configurations or no auth caching should deprioritize this CVE. Organizations with legacy or unsecured authentication channels face elevated risk.

An attacker positioned on a network segment carrying Dovecot OTP authentication traffic (e.g., internal corporate network, compromised ISP, or man-in-the-middle position) observes a legitimate user authenticate using a one-time password, capturing the OTP value and username. If the target organization uses Dovecot with auth caching enabled and performs username alteration in passdb (e.g., stripping domain or lowercasing), the attacker replays the captured OTP credentials within the cache validity window and successfully authenticates as the victim user. The high attack complexity arises from the requirement to observe the exchange and understand the specific passdb configuration, but successful exploitation grants full account access without triggering the legitimate OTP generator or user notification.