If you run MariaDB or Dovecot — and if you host anything resembling a mail server backed by a database, you almost certainly do — there are security advisories from the past few weeks that should already be applied. If they are not, this is your reminder.

MariaDB: Four CVEs, One with Potential Remote Code Execution

On September 7, 2026, MariaDB published advisories covering four CVEs affecting every major supported branch. None are rated Critical, but three score in the 8.0–8.5 High range, which is close enough to warrant attention.

The most serious is CVE-2026-107815 (CVSS 8.5), a boundary-check error in the CONNECT storage engine. Researchers demonstrated remote code execution in lab conditions; MariaDB reports no confirmed in-the-wild exploitation. If you do not use the CONNECT plugin, you can disable it as an immediate workaround — that removes the exposure entirely.

CVE-2026-107821 (CVSS 8.0) involves how MariaDB parses binary .frm table definition files. A malformed file can crash the server or trigger out-of-bounds access, with a plausible path to code execution. The attacker needs the FILE privilege and a permissive secure-file-priv setting, so a well-locked-down installation is at lower practical risk than the score implies.

CVE-2026-102523 (CVSS 8.0) is a privilege escalation in ALTER TABLE ... CONVERT ... PARTITION handling. An attacker with low database privileges could read or modify tables outside their grant. This one requires user interaction to trigger — a vague qualifier, but it does place it below fully autonomous exploitation.

Finally, CVE-2026-107819 (CVSS 5.9) affects Connector/C’s Zero-Configuration SSL. A man-in-the-middle can exploit this to downgrade authentication to cleartext when a certificate is valid but mismatched. If your application and database servers communicate over a private, trusted network, the urgency is lower. If they cross a less-trusted boundary, update Connector/C to 3.4.10.

Fixed server versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Run mariadbd --version to see where you stand. When upgrading, stay within your current major branch — a jump from 10.11 to 11.x can introduce schema-level differences that require a full dump-and-restore.

Dovecot: Nine CVEs in Debian, a Fresh High-Severity in RHEL

Dovecot has had a busy patch cycle. The Debian security team published ELA-1751-1, addressing nine CVEs in the version shipped with Buster. Most are denial-of-service paths: excessive IMAP parentheses, oversized ManageSieve authentication literals, and unrestricted RFC 2231 MIME parameters that peg CPU. Annoying in production; lethal if you haven’t rate-limited connections.

More notable is CVE-2026-33603 in that same batch. A crafted base64 exchange can fake SCRAM TLS channel binding, allowing an active man-in-the-middle to eavesdrop on what should be an encrypted authentication session. This is not a remote unauthenticated attack, but it is a real credential exposure risk on a network that is not as clean as assumed. The fixed Debian package is 1:2.3.4.1-5+deb10u9.

For Red Hat-family systems, RHSA-2026:42091 covers CVE-2026-42006 (CVSS 7.5) in Dovecot on RHEL 9, described as a flaw that could allow unauthorized access to mail data or denial of service. The advisory recommends updating dovecot, dovecot-mysql, and dovecot-pigeonhole together; updating the server package alone may leave the MySQL authentication plugin at the older, vulnerable build.

Run dovecot --version to see your current version.

What This Means for Kalfaoglu.net Customers

Shared hosting customers are covered — the underlying stack is managed. If you are on a VPS or a dedicated server where you control the software, now is the time to update.

On Debian/Ubuntu: apt update && apt upgrade dovecot-core dovecot-imapd dovecot-pop3d

On AlmaLinux/Rocky/RHEL: dnf update mariadb-server dovecot dovecot-mysql dovecot-pigeonhole

Neither update should require application changes, but it is worth watching logs for a few minutes after the Dovecot restart to catch any unexpected authentication errors.

If you are not sure which versions are running on your server, mariadbd --version and dovecot --version will tell you in two seconds. That is the first step. The second is applying the patch.