CVE-2026-33603 — Attacker can use a specially crafted base64 exchange

title: CVE-2026-33603 - Suspicious Base64 Exchange in Dovecot Client Communication
id: scw-2026-05-12-ai-1
status: experimental
level: high
description: |
  This rule detects a suspicious Base64 exchange during Dovecot client communication on standard IMAP ports (143, 993). This specific pattern is indicative of an attacker attempting to exploit CVE-2026-33603 by faking SCRAM TLS channel binding through a specially crafted Base64 exchange, enabling Man-in-the-Middle (MITM) attacks to eavesdrop on communications.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-33603/
tags:
  - attack.lateral_movement
  - attack.t1557.001
logsource:
    category: email
detection:
  selection:
      dst_port:
          - '143'
          - '993'
      cs-uri-query|contains:
          - 'base64'
      cs-method:
          - 'POST'
      sc-status:
          - '200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse