OX Dovecot Pro CVE-2026-40018

The CVSS vector (PR:N/UI:N/AV:N) indicates no authentication and no user interaction are required, and the attack is network-reachable. However, AC:H is a critical limiting factor: exploitation requires a non-standard or specific condition - which could be a particular protocol state, a specific configuration option, a multi-step request sequence, or a race condition - that is not derivable from available data due to the empty CVE description. The vendor advisory (OXDC-ADV-2026-0003) is the authoritative source for the precise triggering condition. What limits exploitation: the AC:H complexity requirement means opportunistic mass-scanning is unlikely to succeed without understanding the specific prerequisite; the A:N impact means denial-of-service is not achievable via this vector. Authentication requirements: CVSS PR:N confirms no authentication is required.

The CVSS 7.4 base score is substantiated by the high confidentiality and integrity impact, but the AC:H metric is a meaningful moderating factor - exploitation requires non-trivial conditions that are not fully described due to the malformed CVE description. EPSS data is not provided in the input, so exploitation probability cannot be quantified. KEV status is not indicated, and no public exploit has been identified, placing this in the 'no public exploit' tier. From an SSVC perspective: exploitation status is none/public-available (no confirmed active exploitation), the automatable dimension is likely 'no' given AC:H, and technical impact is partial-to-total on confidentiality and integrity. Practically, the combination of PR:N and AV:N means a network-exposed OX Dovecot instance with no authentication barrier on the vulnerable endpoint is at genuine risk if the specific triggering condition is met - even a mid-sized mail hosting operation with dozens of customer domains should treat this as a priority patch, not merely a theoretical concern. The missing CVE description is a material gap: affected versions, the specific injection point, and triggering conditions are only inferable from the CVSS vector and vendor advisory, which has not been independently read here.

A remote, unauthenticated attacker identifies a network-accessible OX Dovecot Pro instance and sends a crafted protocol or HTTP request containing SQL metacharacters to a vulnerable input field, such as a login parameter or mail query endpoint. Under the specific conditions that satisfy AC:H (exact nature unknown due to missing description), the injected SQL executes against the backend database, returning sensitive data such as user credentials or mailbox metadata, or modifying records. No public exploit code has been identified, so exploitation currently requires independent discovery of the triggering condition.