CVE-2026-40018
published 2026-08-28CVE-2026-40018: None None None No publicly available exploits are known.
PriorityP342high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.32%
23.4th percentile
None None None No publicly available exploits are known.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.0 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Open-Xchange Dovecot Pro/Dovecot CE sql injection (Nessus ID 341528 / WID-SEC-2026-3076)
vuldb·2026-09-07·CVSS 7.4
CVE-2026-40018 [HIGH] Open-Xchange Dovecot Pro/Dovecot CE sql injection (Nessus ID 341528 / WID-SEC-2026-3076)
A vulnerability has been found in Open-Xchange Dovecot Pro and Dovecot CE and classified as critical. This affects an unknown function. This manipulation causes sql injection.
The identification of this vulnerability is CVE-2026-40018. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
None None None No publicly available exploits are known.
ghsa_unreviewed·2026-08-28
CVE-2026-40018 [HIGH] CWE-89 None None None No publicly available exploits are known.
None None None No publicly available exploits are known.
Red Hat
dovecot: Dovecot: MySQL multi-byte escaping wrong
vendor_redhat·2026-08-28·CVSS 7.4
CVE-2026-40018 [HIGH] CWE-89 dovecot: Dovecot: MySQL multi-byte escaping wrong
dovecot: Dovecot: MySQL multi-byte escaping wrong
None None None No publicly available exploits are known.
A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: dovecot (Red Hat Enterprise Linux 10) - Affected
Package: dovecot (Red Hat Enterprise Linux 6) - Out of support scope
Package: dovecot (Red Hat Enterprise Linux 7) - Affected
Package: dovecot (Red Hat Enterprise
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
bugzilla·2026-09-01·CVSS 7.4
CVE-2026-40018 [HIGH] CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
None None None No publicly available exploits are known.
Bugzilla
CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
bugzilla·2026-09-01·CVSS 7.4
CVE-2026-40018 [HIGH] CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
None None None No publicly available exploits are known.
Bugzilla
CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [epel-all]
bugzilla·2026-09-01·CVSS 7.4
CVE-2026-40018 [HIGH] CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [epel-all]
CVE-2026-40018 perl-Email-Address-XS: Dovecot: MySQL multi-byte escaping wrong [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
None None None No publicly available exploits are known.
Bugzilla
CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong
bugzilla·2026-08-28·CVSS 7.4
CVE-2026-40018 [HIGH] CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong
CVE-2026-40018 dovecot: Dovecot: MySQL multi-byte escaping wrong
None None None No publicly available exploits are known.
2026-08-28
Published