Security readout for executives and security teams
Plain-English summary
CVE-2026-27851 is a high-severity OX Dovecot Pro escaping flaw. A supposedly safe template filter can cause later processing on the same string to be treated as safe, allowing unsafe data to remain unescaped. In authentication paths, that may expose SQL or LDAP backends to injection risk.
Executive priority
Treat as a high-priority exposure check for mail/authentication infrastructure. Immediate urgency depends on whether your deployment uses the vulnerable safe-filter pattern and SQL or LDAP authentication. There is no cited evidence of public exploitation, but the potential authentication impact warrants prompt validation.
Technical view
The flaw involves safe filter handling with variable expansion: subsequent pipelines on the same string are incorrectly interpreted as safe. The CVSS 3.1 score is 7.4, network exploitable, no privileges or user interaction required, but high attack complexity. The cited sources associate it with CWE-235 and CWE-89.
Likely exposure
Exposure appears limited to OX Dovecot Pro deployments using the affected safe-filter pattern, especially in authentication logic touching SQL or LDAP. The affected-version data in the bundle is incomplete or ambiguous, so teams should confirm applicability against vendor and distribution advisories.
Exploitation context
The bundle states no publicly available exploits are known, and KEV is false. Do not treat this as confirmed active exploitation. Risk is still meaningful because successful exploitation could compromise confidentiality and integrity in authentication-related data flows.
Researcher notes
The source bundle gives clear vulnerability mechanics but weak affected-version detail: the affected entry lists version values of 0 and defaultStatus unaffected. Researchers should avoid broad product claims and focus validation on safe-filter plus variable-expansion behavior in OX Dovecot Pro authentication-related pipelines.
Mitigation direction
- Avoid using the safe filter until running a vendor-confirmed fixed version.
- Check Open-Xchange guidance for the fixed release and affected configuration details.
- Review Red Hat advisories or VEX data if using packaged Dovecot components.
- Prioritize remediation for systems where authentication queries use SQL or LDAP.
- Monitor authentication logs for unusual query failures or account lookup anomalies.
Validation and detection
- Inventory OX Dovecot Pro deployments and record exact installed versions.
- Search templates/configuration for safe filter usage with variable expansion.
- Identify whether those paths feed authentication, SQL, or LDAP lookups.
- Compare package status against Open-Xchange and Red Hat advisory data.
- Document any ambiguous version findings for vendor confirmation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-235: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27851 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2OXCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-12T14:01:35.826Z: Reported to Red Hat.
- 2026-05-12T13:28:43.846Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.jsonCVE reference, OX · vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-27851CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2476471CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27851.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Extra Parameters
Improper Handling of Extra Parameters represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.