Contact us
Vulnerability lookup

CVE-2026-4873

medium CVSS 5.9 EPSS 0.4%

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

Versions it affects

Software versions checked with the free lookup that CVE-2026-4873 applies to, and the release that fixes it where the sources name one.

At a glance

Severity
Medium
CVSS base score
5.9 out of 10
Known exploited
Not in CISA's catalogue of exploited vulnerabilities
EPSS
0.4% probability of exploitation in the next 30 days, higher than 28% of scored vulnerabilities
Weakness
CWE-295
Published
2026-05-13

Is this running somewhere in your estate?

The Vulnerability Reporter inventories every machine and tells you when an advisory like this one applies to you.