Get real-time updates on Telegram
CVE-2026-47081: Cyrus IMAP 0 to before 3.12.3
CVE-2026-47081. CVSS 3.1 base score 3.1 (LOW, Vendor/CNA). EPSS 0.00243 (percentile 0.14678), scored 24-Oct-2026.
Affected technology
Cyrus IMAP · 0 to before 3.12.3
cyrusimap
Description’s affected range: through 3.12.2
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. Vendor/CNA’s CVSS 3.1 assessment (base score 3.1/10) rates confidentiality impact as low; integrity and availability impact as none.
- CWE
- CWE-863
- CCR priority
- 12.5 /100 (P5)
- CVSS 3.1
- 3.1 /10 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · Vendor/CNA
- EPSS
- 0.00243 · percentile 0.14678 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-47081.html