Cyrus IMAP CVE-2026-47082

Exploitation requires the attacker to hold a valid authenticated account on the Cyrus IMAP server (PR:L per CVSS vector) and to have ManageSieve access sufficient to create or modify a vacation Sieve script using the :fcc parameter. The server must have the vacation Sieve extension and fcc capability enabled - non-default configurations that disable these extensions are not exploitable. The attack is passive after script deployment: exploitation is triggered by any inbound email that activates the vacation auto-responder, meaning the attacker does not need to interact further once the script is in place. Exploitation is limited to injecting copies of vacation auto-reply messages into target mailboxes on the same Cyrus instance; it does not grant read access to those mailboxes (C:N) and does not allow arbitrary file writes to the filesystem.

CVSS 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects a network-reachable but authentication-gated flaw. No EPSS score was included in the provided intelligence, and no CISA KEV entry exists, indicating no confirmed widespread exploitation. The A:L component is consistent with mailbox flooding via repeated inbound-email-triggered vacation responses; C:N confirms no read-access bypass. Real-world risk is elevated primarily in multi-tenant Cyrus deployments - academic institutions, ISPs, and hosted email providers - where untrusted authenticated users share a single Cyrus instance and could target colleagues' or administrators' mailboxes. Single-tenant enterprise deployments where all users are trusted face substantially lower risk. This is a patch-priority item rather than an emergency: attack complexity is low once a user can write Sieve scripts, but impact scope is bounded to unauthorized message delivery within the same server.

An authenticated Cyrus IMAP user with ManageSieve access uploads a vacation Sieve script specifying a high-value target mailbox - such as a shared administrative inbox or another user's private folder - as the :fcc destination. Once in place, every inbound email to the attacker's account triggers a vacation auto-reply, and a copy is silently delivered to the target mailbox in violation of its ACL. By arranging or waiting for a volume of inbound messages, the attacker can inject repeated messages into the target mailbox, potentially cluttering or flooding it. No public proof-of-concept code is known at time of analysis.