OX Dovecot CVE-2026-33607

Exploitation requires valid IMAP account credentials on the target OX Dovecot instance (PR:L per CVSS vector). The attacker must be able to reach the IMAP service over the network (AV:N, AC:L), which in typical enterprise deployments means access to port 143 or 993. No user interaction is required from other users or administrators. Exploitation is limited to availability impact only - no data exfiltration or integrity modification is possible through this vector. The key limiting factor is the authenticated-access requirement: unauthenticated or anonymous IMAP access must be blocked for this to remain a low-blast-radius issue. Environments that permit IMAP access from untrusted networks with weak credential hygiene face elevated risk.

Real-world risk is moderate-to-low. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L confirms network-reachable exploitation with low attack complexity but requires valid credentials (PR:L), limiting the attacker pool to authenticated mail users or compromised accounts. Impact is confined to partial availability (A:L), with no confidentiality or integrity effect. No CISA KEV listing and no publicly available exploit code further reduce urgency. EPSS data is not provided, but given the authenticated-only requirement and limited scope, real-world exploitation probability is expected to be low. The primary concern is a malicious or abusive authenticated user - an insider threat or a compromised mailbox - deliberately degrading IMAP service for other users. This does not constitute a full service outage on its own but can degrade responsiveness.

An authenticated IMAP user - whether a malicious insider or an attacker who has obtained valid mail credentials through phishing or credential stuffing - connects to the IMAP server and repeatedly issues crafted LIST commands designed to maximize server-side CPU consumption. Over time or at scale, this degrades IMAP responsiveness for all users sharing the same server process, potentially causing timeouts and disconnections. No public proof-of-concept exists, but the attack primitive (issuing standard IMAP LIST commands) requires no specialized tooling beyond a basic IMAP client.