VDB
CVE-2026-27860
CVE-2026-27860
PUBLISHED
CVSS 3.700000047683716 LOW
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
EPSS 0.04% · 12.3th percentile
Risk Scores
CVSS v3.1
3.700000047683716
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.04%
12.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| open-xchange | dovecot | 0 |
| Open-Xchange GmbH | OX Dovecot Pro | 0, 0, 0 |
| dovecot | dovecot | 0 |
Timeline
- Mar 27, 2026 Coalition ESS Score
- Mar 27, 2026 CVE Published
- Mar 27, 2026 PoC Published
- Mar 29, 2026 Security Advisory
- Mar 30, 2026 PoC Published
- Apr 29, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score