OVHcloud Email EUVD-2026-94378

Requires a valid, authenticated OVH email account (PR:L) with access to OVH's outbound SMTP servers. The spoofing succeeds specifically against OVH-hosted recipient domains whose DNS uses OVH's default SPF record containing include:mx.ovh.com, because that record authorizes the shared mx.ovh.com infrastructure for every such domain. Limiting factors: exploitation is constrained to domains relying on this default/shared SPF configuration, and the practical impact is reduced for victim domains that enforce DMARC with DKIM alignment, since a passing SPF check on a shared relay does not satisfy From-header alignment - only SPF-only or misaligned-DMARC domains are fully spoofable.

This is a real but moderate, bounded risk rather than a critical priority. The CVSS 4.0 score of 6.3 (Medium) is driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality, availability, or vulnerable-system impact (VC:N/VI:N/VA:N) - correctly reflecting that this is an email sender-spoofing/authentication-bypass flaw, not a data-exposure or code-execution issue. The vector (AV:N/AC:L/PR:L/UI:N) shows network-reachable, low-complexity exploitation that still requires a valid authenticated OVH account (PR:L), which meaningfully limits the attacker pool to anyone who can register/hold any OVH mailbox. Notably, the input CVSS 4.0 vector includes E:A (Exploitation: Attacked), which suggests the vendor/reporter believes exploitation has been observed; however, there is no CISA KEV entry and no POC flag in the provided data, so per analysis rules this is treated as 'no public exploit identified' while flagging the E:A/KEV discrepancy. No EPSS score was provided, so widespread-exploitation probability cannot be quantified. The 'Information Disclosure' tag conflicts with the CVSS impact profile (VC:N, SI:H), indicating the tag is mislabeled - this is a spoofing/integrity issue, not disclosure. Net: a credible cross-domain spoofing/phishing-enablement weakness worth remediating, but its impact is further constrained by whether victim domains enforce DMARC with DKIM alignment, which would blunt From-header forgery even when SPF passes.

An attacker registers or obtains any valid OVH email account, authenticates to OVH's SMTP servers, and sends messages with a forged 'From' and 'Envelope-from' set to a victim OVH-hosted domain (e.g. billing@victim-company.fr). Because the victim domain's default SPF record authorizes mx.ovh.com, the forged mail passes SPF validation and lands as apparently-legitimate, enabling convincing phishing or business-email-compromise. No public exploit code is identified, and the technique requires only standard authenticated SMTP, so no special tooling is needed.