# CVE-2026-27856: Dovecot Doveadm timing oracle vulnerability in credential verification

Source: https://junglewise.ai/threats/cve-2026-27856-dovecot-doveadm-timing-oracle-vulnerability-in-credential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-27856 · Severity: high · CVSS 7.4 · Published 2026-03-27

Dovecot, a widely used email server, contains a security flaw in its administrative tool (doveadm). An attacker can exploit a timing discrepancy during password verification to guess administrative credentials. If successful, the attacker could gain full administrative access to the email service, potentially allowing them to access or modify user data and system configurations.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-27856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27856 being exploited in the wild.

**How severe is CVE-2026-27856?** High severity, with a CVSS score of 7.4, published 27 March 2026.

**Which products and versions are affected?** Dovecot up to (excluding) 2.4.3; Open-Xchange Dovecot Pro up to (excluding) 2.3.22.1, 3.0.0 to 3.0.5, 3.1.0 to 3.1.4.

**Is there a fix for CVE-2026-27856?** A patch was published on 2026-06-17: Red Hat released security updates for RHEL 7 ELS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27856 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27856?** Check whether you run Dovecot or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A timing oracle vulnerability exists in the doveadm component of Dovecot due to the use of direct string comparison for credential verification. Because standard string comparison functions often return early upon finding a mismatch, an attacker can measure the time taken for the server to respond to various authentication attempts to determine the correct characters of a password. This attack is typically performed over the network against the doveadm HTTP service port. Successful exploitation allows an attacker to recover administrative credentials, leading to unauthorized access and full control over the Dovecot instance. Users are advised to restrict access to the doveadm HTTP port and upgrade to fixed versions (e.g., Dovecot 2.4.3 or OX Dovecot Pro 3.1.4).

## Affected products

- Dovecot Dovecot up to (excluding) 2.4.3
- Open-Xchange OX Dovecot Pro up to (excluding) 2.3.22.1, 3.0.0 to 3.0.5, 3.1.0 to 3.1.4
- Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) 7

## Timeline

- 2026-03-27: advisory: Initial public release of the advisory
- 2026-06-17: patched: Red Hat released security updates for RHEL 7 ELS

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json)
- [https://access.redhat.com/errata/RHSA-2026:26564](https://access.redhat.com/errata/RHSA-2026:26564)
- [https://access.redhat.com/security/cve/CVE-2026-27856](https://access.redhat.com/security/cve/CVE-2026-27856)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452171](https://bugzilla.redhat.com/show_bug.cgi?id=2452171)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27856.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27856.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)