CVE-2026-73208 – OX Dovecot Pro
CVSS 7.4
IMPORTANT
Critical - Same Day Deployment
“Mail processing and OAuth trust flaws can expose memory, enable code execution, and bypass intended authentication controls.”
OX Dovecot Pro addresses two serious vulnerabilities. CVE-2026-42007 is a Sieve editheader use-after-free that can corrupt memory during mail delivery, crash the delivery process, and potentially allow arbitrary code execution. The CVSS score is 9.1, which is Critical severity.
CVE-2026-73208 is an OAuth2 authentication flaw that can accept a token intended for another purpose when the scope claim is missing and the audience value matches a required scope. This can grant access that should have been denied. The CVSS score is 7.4, which is High severity.
Key Details
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-287
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.