CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection

Overview

Severity: Medium (CVSS 5.9)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Exploit Status: Not Exploited
Patch Tuesday: 2026-Oct
Released: 2026-10-23
EPSS Score: 0.21% (percentile: 10.2%)

Affected Products (4)

Other

21862-17084
21840-17084
21918-17084
21021-17084

Revision History

2026-10-23: Information published.