August 1, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-27651NVD

Vulnerability Summary

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity Level
HIGH(7.5)
Published Date
Mar 24, 2026
Last Modified
Jul 15, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.94%Probability
Root Weakness (CWE)
N/A
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh