CVE-2026-27847

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 25, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-278489.8Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimateCVE-2026-278499.8Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which iCVE-2026-27859.8Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and ThuCVE-2026-278507.5Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing allCVE-2026-278519.1When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabliCVE-2026-278527.5An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parametersCVE-2026-278537.5An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName oCVE-2026-278547.5An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions methoCVE-2026-278555.9Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in paCVE-2026-278565.9Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determineCVE-2026-278577.5Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client CVE-2026-278587.5Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacke