# Open-Xchange Dovecot Pro vulnerabilities Source: https://junglewise.ai/threats/technologies/dovecot-pro Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/dovecot-pro.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in Open-Xchange Dovecot Pro: 0 in the last 7 days and 19 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-73209, was published on 28 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 19 - All time: 28 (1 critical, 0 exploited in the wild) ## About Open-Xchange Dovecot Pro Open-Xchange mail and groupware server providing email and collaboration services. ## Latest Open-Xchange Dovecot Pro vulnerabilities - [CVE-2026-73209: Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-73208: Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass) (high, CVSS 7.4, published 28 Aug 2026) - [CVE-2026-52687: Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression) (medium, CVSS 6.5, published 28 Aug 2026) - [CVE-2026-52681: Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass) (low, CVSS 3.1, published 28 Aug 2026) - [CVE-2026-42395: Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-42392: Open-Xchange Dovecot information disclosure in IMAP URLFETCH](https://junglewise.ai/threats/cve-2026-42392-open-xchange-dovecot-information-disclosure-in-imap-urlfetch) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-42391: OX Dovecot Pro denial of service via malformed IMAP ID command](https://junglewise.ai/threats/cve-2026-42391-ox-dovecot-pro-denial-of-service-via-malformed-imap-id-command) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-42008: Open-Xchange Dovecot trusted proxy authentication bypass](https://junglewise.ai/threats/cve-2026-42008-open-xchange-dovecot-trusted-proxy-authentication-bypass) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-42007: Open-Xchange Dovecot use-after-free in Sieve editheader extension](https://junglewise.ai/threats/cve-2026-42007-open-xchange-dovecot-use-after-free-in-sieve-editheader-extension) (critical, CVSS 9.1, published 28 Aug 2026) - [CVE-2026-40205: Open-Xchange Dovecot OAuth2 scope validation bypass](https://junglewise.ai/threats/cve-2026-40205-open-xchange-dovecot-oauth2-scope-validation-bypass) (medium, CVSS 5.9, published 28 Aug 2026) - [CVE-2026-40204: Open-Xchange Dovecot authentication bypass](https://junglewise.ai/threats/cve-2026-40204-open-xchange-dovecot-authentication-bypass) (low, CVSS 3.1, published 28 Aug 2026) - [CVE-2026-40203: Open-Xchange Dovecot IMAP compression information disclosure](https://junglewise.ai/threats/cve-2026-40203-open-xchange-dovecot-imap-compression-information-disclosure) (low, CVSS 3.7, published 28 Aug 2026) - [CVE-2026-40019: Open-Xchange Dovecot ManageSieve infinite loop denial of service](https://junglewise.ai/threats/cve-2026-40019-open-xchange-dovecot-managesieve-infinite-loop-denial-of-service) (medium, CVSS 5.9, published 28 Aug 2026) - [CVE-2026-40018: Open-Xchange Dovecot authentication bypass](https://junglewise.ai/threats/cve-2026-40018-open-xchange-dovecot-authentication-bypass) (high, CVSS 7.4, published 28 Aug 2026) - [CVE-2026-40015: Open-Xchange Dovecot IMAP hibernation denial of service](https://junglewise.ai/threats/cve-2026-40015-open-xchange-dovecot-imap-hibernation-denial-of-service) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-33607: Open-Xchange Dovecot CPU exhaustion in IMAP LIST](https://junglewise.ai/threats/cve-2026-33607-open-xchange-dovecot-cpu-exhaustion-in-imap-list) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-33606: Open-Xchange Dovecot dsync protocol injection via mail content](https://junglewise.ai/threats/cve-2026-33606-open-xchange-dovecot-dsync-protocol-injection-via-mail-content) (medium, CVSS 4.8, published 28 Aug 2026) - [CVE-2026-33605: Dovecot ManageSieve denial of service via malformed pre-auth command](https://junglewise.ai/threats/cve-2026-33605-dovecot-managesieve-denial-of-service-via-malformed-pre-auth) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-33263: OX Dovecot submission-login denial of service via file descriptor handling](https://junglewise.ai/threats/cve-2026-33263-ox-dovecot-submission-login-denial-of-service-via-file-descriptor) (medium, CVSS 4.3, published 28 Aug 2026) - [CVE-2026-42006: Open-Xchange Dovecot uncontrolled memory consumption in IMAP](https://junglewise.ai/threats/cve-2026-42006-open-xchange-dovecot-uncontrolled-memory-consumption-in-imap) (medium, CVSS 4.3, published 12 May 2026) - [CVE-2026-40020: Open-Xchange Dovecot improper access control in IMAP SETACL](https://junglewise.ai/threats/cve-2026-40020-open-xchange-dovecot-improper-access-control-in-imap-setacl) (low, CVSS 3.1, published 12 May 2026) - [CVE-2026-40016: Open-Xchange Dovecot CPU limit bypass in Sieve scripts](https://junglewise.ai/threats/cve-2026-40016-open-xchange-dovecot-cpu-limit-bypass-in-sieve-scripts) (medium, CVSS 5.3, published 12 May 2026) - [CVE-2026-33603: Open-Xchange Dovecot SCRAM TLS channel binding spoofing](https://junglewise.ai/threats/cve-2026-33603-open-xchange-dovecot-scram-tls-channel-binding-spoofing) (medium, CVSS 6.8, published 12 May 2026) - [CVE-2026-27851: Open-Xchange Dovecot injection via unsafe variable expansion](https://junglewise.ai/threats/cve-2026-27851-open-xchange-dovecot-injection-via-unsafe-variable-expansion) (high, CVSS 7.4, published 12 May 2026) - [CVE-2026-27858: Open-Xchange Dovecot denial of service in ManageSieve](https://junglewise.ai/threats/cve-2026-27858-open-xchange-dovecot-denial-of-service-in-managesieve) (high, CVSS 7.5, published 27 Mar 2026) ## Most severe Open-Xchange Dovecot Pro vulnerabilities - [CVE-2026-42007: Open-Xchange Dovecot use-after-free in Sieve editheader extension](https://junglewise.ai/threats/cve-2026-42007-open-xchange-dovecot-use-after-free-in-sieve-editheader-extension) (critical, CVSS 9.1, published 28 Aug 2026) - [CVE-2026-42391: OX Dovecot Pro denial of service via malformed IMAP ID command](https://junglewise.ai/threats/cve-2026-42391-ox-dovecot-pro-denial-of-service-via-malformed-imap-id-command) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-33605: Dovecot ManageSieve denial of service via malformed pre-auth command](https://junglewise.ai/threats/cve-2026-33605-dovecot-managesieve-denial-of-service-via-malformed-pre-auth) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-27858: Open-Xchange Dovecot denial of service in ManageSieve](https://junglewise.ai/threats/cve-2026-27858-open-xchange-dovecot-denial-of-service-in-managesieve) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2025-59032: Open-Xchange Dovecot denial of service in ManageSieve AUTHENTICATE](https://junglewise.ai/threats/cve-2025-59032-open-xchange-dovecot-denial-of-service-in-managesieve) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-40018: Open-Xchange Dovecot authentication bypass](https://junglewise.ai/threats/cve-2026-40018-open-xchange-dovecot-authentication-bypass) (high, CVSS 7.4, published 28 Aug 2026) - [CVE-2026-73208: Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass) (high, CVSS 7.4, published 28 Aug 2026) - [CVE-2026-27856: Dovecot Doveadm timing oracle vulnerability in credential verification](https://junglewise.ai/threats/cve-2026-27856-dovecot-doveadm-timing-oracle-vulnerability-in-credential) (high, CVSS 7.4, published 27 Mar 2026) - [CVE-2026-27851: Open-Xchange Dovecot injection via unsafe variable expansion](https://junglewise.ai/threats/cve-2026-27851-open-xchange-dovecot-injection-via-unsafe-variable-expansion) (high, CVSS 7.4, published 12 May 2026) - [CVE-2026-33603: Open-Xchange Dovecot SCRAM TLS channel binding spoofing](https://junglewise.ai/threats/cve-2026-33603-open-xchange-dovecot-scram-tls-channel-binding-spoofing) (medium, CVSS 6.8, published 12 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 19 | 1 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Open-Xchange technologies - [Open-Xchange Dovecot CE](https://junglewise.ai/threats/technologies/dovecot-ce): 8 vulnerabilities - [Open-Xchange Dovecot](https://junglewise.ai/threats/technologies/open-xchange-dovecot): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Open-Xchange Dovecot Pro vulnerabilities", https://junglewise.ai/threats/technologies/dovecot-pro, 9 November 2026.