Quick answers
- Is CVE-2026-33606 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33606 being exploited in the wild.
- How severe is CVE-2026-33606?
- Medium severity, with a CVSS score of 4.8, published 28 August 2026.
- Which products and versions are affected?
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5.
- Is there a fix for CVE-2026-33606?
- A patch was published on 2026-08-28: Fixed in versions 2.3.22.2, 3.0.7, 3.1.6 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33606 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-33606?
- Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a protocol injection flaw in OX Dovecot Pro's dsync stream protocol handler. An unprivileged user can craft mail content containing specially formatted data that, when an administrator later runs dsync with the stream protocol (commonly during mailbox migration or replication), is parsed as dsync commands rather than data. This allows an attacker to modify internal mailbox state and attributes on the destination system that users should not be able to set directly. The attack requires the administrator to explicitly run dsync; no publicly available exploits are currently known. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 and later.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
Timeline
- 2026-08-28: disclosed: Public advisory released by Open-Xchange
- 2026-08-28: patched: Fixed in versions 2.3.22.2, 3.0.7, 3.1.6 and later