CVE-2025-23394: Suse Opensuse Tumbleweed

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

Affected products

• Suse Opensuse Tumbleweed

Published 2025-05-26. Last modified 2026-06-17.