{"id":"CVE-2026-33586","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-33586","generatedAt":"2026-10-28T04:13:36.216Z","title":"Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers.","description":"Authenticated users are able to manipulate both the SMTP\nenvelope “Envelope-from” and “From” fields when sending\nemails through OVH mail servers.\n\n\n\nDue to OVH's default SPF configuration, which\ncommonly includes include:mx.ovh.com, any authenticated user with a\nvalid OVH email account can send messages that appear to originate from any\nOVH-hosted domains using the default SPF record. Since the SPF policy\nexplicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of\nthese domains, forged messages successfully pass SPF validation despite\nnot being authorized by the impersonated domain owner.","published":"2026-10-07T16:17:48.000Z","lastModified":"2026-10-08T21:33:42.000Z","status":"Awaiting Analysis","sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","cvss":{"version":"4.0","score":6.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-290","CWE-346","CWE-1188"],"affected":[],"epss":{"score":0.00139,"percentile":0.03255,"date":"2026-10-27","history":[{"date":"2026-10-08","score":0.00139,"percentile":0.02813}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-07T16:17:48.000Z","detail":{"score":"6.3","severity":"MEDIUM","publishedAt":"2026-10-07T16:17:47.643Z"},"summary":"New CVE, medium severity (CVSS 6.3)."}],"references":[{"url":"https://docs.ovhcloud.com/en/guides/web-cloud/email-and-collaborative-solutions/troubleshooting/email-rejected-cross-domain-spoofing","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-33586","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}