Review reviewHigh

CVE-2026-27858

Open-Xchange GmbH OX Dovecot Pro, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

CVSS: 7.5
EPSS: 0.79%
CISA KEV: Not listed
Published: 2026.03.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.79%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Open-Xchange GmbH OX Dovecot Pro, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions: <= 2.3.0, <= 3.1.0, <= 2.4.0, < 2.4.3, < 2.3.22.1, >= 3.0.0 < 3.0.5, >= 3.1.0 < 3.1.4
Fixed versions: 2.4.3, 2.3.22.1, 3.0.5, 3.1.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Open-Xchange GmbH OX Dovecot Pro, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-400, CWE-770