Ox Dovecot Pro CVE-2026-27856

Remote network access to Dovecot doveadm HTTP service port. Attacker performs timing oracle attack on credential verification endpoint to extract configured credentials through timing side-channel analysis. No authentication or user interaction required. Affects Dovecot installations exposing doveadm HTTP service to untrusted networks.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates network-accessible unauthenticated exploitation with high attack complexity, high confidentiality and integrity impact but no availability impact. The high attack complexity (AC:H) reflects the technical sophistication required to perform timing oracle attacks, which demand precise timing measurements and statistical analysis over many authentication attempts. Real-world exploitation feasibility is moderate: while network-accessible and requiring no privileges (AV:N/PR:N), successful timing attacks require controlled network conditions to minimize jitter and sophisticated statistical techniques to extract credential information. No EPSS score is provided, KEV status is not indicated as active, and no public exploits are known, reducing immediate risk. The primary risk factor is the complete administrative access granted upon successful credential extraction, though the attack complexity and requirement for exposed doveadm HTTP ports (typically internal-only by default) mitigate widespread exploitation. Organizations with internet-exposed doveadm services face elevated risk.

An unauthenticated remote attacker sends thousands of authentication requests to an internet-exposed doveadm HTTP service, systematically testing different credential values while precisely measuring server response times. By analyzing microsecond-level timing variations in authentication failures, the attacker uses statistical techniques to identify which characters at each position match the valid credential, progressively reconstructing the full password. Once the credential is obtained, the attacker authenticates to the doveadm service and gains full administrative control over mailbox operations, user accounts, and email system configuration.