How severe is CVE-2026-33550?

CVE-2026-33550 has a CVSS 3.x base score of 2.0, rated low severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-33550 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33550?

CVE-2026-33550 affects Alinto Sogo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33550?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-33550 have an EU (EUVD) identifier?

Yes. CVE-2026-33550 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-14269.

When was CVE-2026-33550 published?

CVE-2026-33550 was published on 2026-03-22 and last updated on 2026-06-17.

CVE-2026-33550

CVE-2026-33550 is a low-severity vulnerability in Alinto Sogo with a CVSS 3.x base score of 2.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-308.

Key facts

Severity: Low (CVSS 3.x base score 2.0)
EPSS exploit prediction: 0% (3rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-14269
Weakness: CWE-308
Affected product: Alinto Sogo
Published: 2026-03-22
Last modified: 2026-06-17

Description

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

Frequently asked questions

What is CVE-2026-33550?: SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
How severe is CVE-2026-33550?: CVE-2026-33550 has a CVSS 3.x base score of 2.0, rated low severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-33550 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33550?: CVE-2026-33550 affects Alinto Sogo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33550?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-33550 have an EU (EUVD) identifier?: Yes. CVE-2026-33550 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-14269.
When was CVE-2026-33550 published?: CVE-2026-33550 was published on 2026-03-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:alinto:sogo:*:*:*:*:*:*:*:*

More vulnerabilities in Alinto Sogo

CVE-2015-5395 — High (CVSS 8.8): Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
CVE-2016-6188 — Medium (CVSS 6.5): Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number…
CVE-2025-71276 — Medium (CVSS 6.4): SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
CVE-2025-63499 — Medium (CVSS 6.1): Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
CVE-2025-63498 — Medium (CVSS 6.1): alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
CVE-2024-24510 — Medium (CVSS 6.1): Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via…

All CVEs affecting Alinto Sogo →

Other CWE-308 vulnerabilities

CVE-2023-49075 — High (CVSS 8.4): The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition`…
CVE-2026-45749 — High (CVSS 8.1): Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST…
CVE-2025-42959 — High (CVSS 8.1): An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential,…
CVE-2024-47652 — High (CVSS 8.1): This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in…
CVE-2024-27928 — Medium (CVSS 5.9): vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks…
CVE-2026-56022 — Medium (CVSS 5.3): Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header,…

Browse all CWE-308 vulnerabilities →