Loading story…
Fedora Linux maintainers highlighted a compatibility and security issue between Microsoft Outlook and Dovecot 2.4.3 in POP3 deployments that rely on STARTTLS on port 110. In the reported configuration, Outlook does not correctly negotiate encrypted POP3 before authentication and instead behaves as if it expects implicit TLS on port 995, creating a mismatch with servers configured for explicit TLS upgrade.
As a result, Outlook may transmit POP3 authentication commands such as USER and PASS before encryption is established, potentially exposing mailbox credentials on the network. The behavior was described as a longstanding Outlook limitation dating back to at least Outlook 2007, despite secure POP3 service being available when configured for implicit TLS on port 995.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A compatibility and security-related issue was reported involving Microsoft Outlook and the Dovecot 2.4.3 mail server implementation on Fedora Linux. In the affected configuration, Outlook does not properly use STARTTLS on POP3 port 110 and may expose credentials by attempting authentication before encryption is negotiated.
The reported issue is described as longstanding Microsoft Outlook behavior dating back to at least Outlook 2007, where Outlook may send POP3 USER and PASS commands before TLS is established in certain secure POP3 configurations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcefedoramagazine.org
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open-Xchange disclosed **Dovecot Security Advisory `OXDC-2026-0001`**, detailing 12 confirmed vulnerabilities in OX Dovecot CE and Pro that affect core authentication, login, ManageSieve, LMTP, and indexing-related functionality. The issues span **authentication bypass**, **SQL injection**, **LDAP injection**, **path traversal**, **information disclosure**, **replay and timing attacks**, and multiple **denial-of-service** conditions tied to invalid input, memory exhaustion, CPU exhaustion, and service crashes. One of the most serious flaws, **`CVE-2026-24031`**, can enable authentication bypass through SQL injection when `auth_username_chars` is cleared. The advisory says the most severe impacts include arbitrary-user authentication bypass, repeated crashes in ManageSieve or login services, unintended indexing of local files, and possible credential recovery against `doveadm` HTTP under timing-oracle conditions. Several bugs were described as regressions introduced in Dovecot 2.4 or later. Open-Xchange said most issues were fixed in **OX Dovecot CE 2.4.3** and **OX Dovecot Pro 3.1.4**, with some fixes also available in **Pro 3.0.5**, **Pro 2.3.22.1**, **CE 2.4.1**, and **CE 2.4.0**; it added that no public exploits are known and urged users to upgrade, restrict exposed services, disable vulnerable features, and avoid unsafe configuration choices.
Jun 29, 2026
Attackers exploited **CVE-2023-23397**, a Microsoft Outlook elevation-of-privilege flaw, by sending specially crafted messages that triggered Outlook to authenticate automatically to attacker-controlled servers without user interaction. The vulnerability exposed **NTLM credential hashes** and was used in the wild against government, military, energy, and transportation organizations in Europe, with Microsoft attributing observed activity to a Russia-based threat actor. Research also showed that real attacks used Outlook **task** messages in addition to the appointment-based technique highlighted in early proof-of-concept reporting. Microsoft released a patch and published remediation guidance for Exchange administrators, including a PowerShell tool to identify and clean up malicious items tied to the vulnerable property. The `CVE-2023-23397.ps1` script supports audit and cleanup modes across **Exchange Server** and **Exchange Online**, producing CSV results and allowing administrators to clear the property or delete flagged items. Operational guidance covers required roles, impersonation and authentication setup, and troubleshooting for large mailbox environments, underscoring the need to patch Outlook clients and retroactively hunt for malicious messages in mailboxes.
Aug 15, 2026Microsoft said Russian state-backed threat actor **Forest Blizzard** (also tracked as **APT28** or **STRONTIUM**) actively exploited **`CVE-2023-23397`**, a critical Outlook for Windows elevation-of-privilege flaw that can leak a victim’s **Net-NTLMv2** hash through a specially crafted reminder message **without user interaction**. The stolen hash can then be used in **NTLM relay** attacks against Exchange, allowing attackers to access Exchange-hosted mailboxes, move laterally, and establish persistence. Microsoft said exploitation dated back to at least April 2022 and linked the activity to the GRU-associated actor previously tied by U.S. and U.K. authorities to **Unit 26165**. Reporting from Microsoft and other security firms tied the campaign to broader Russian espionage operations targeting government, military, energy, transportation, research, and other strategic organizations, with Unit 42 saying at least **30 organizations in 14 countries** were affected over roughly 20 months, many in NATO states. Investigators observed attackers abusing **Exchange Web Services** and modifying mailbox folder permissions to retain unauthorized access to mailbox contents, a technique also highlighted by Polish authorities. Microsoft urged defenders to patch Outlook, apply Exchange security updates, block outbound **SMB** on TCP 445, and reduce or disable NTLM exposure; it also noted that **Exchange Online** and updated Exchange Server builds can strip the malicious `PidLidReminderFileParameter` used in the attack chain.
Aug 14, 2026