Unauthenticated OS Command Injection in NUMail

NUMail, developed by Green-Computing, is affected by an OS command injection vulnerability identified as CVE-2026-82082. This vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary system-level commands on the underlying server host. Given the critical CVSS v3.1 base score of 9.8, this flaw presents a significant risk for complete system compromise. Defenders should prioritize identifying instances of NUMail within their infrastructure and monitor for unauthorized process execution originating from the web application's service account. There is currently no evidence of public exploit code or active exploitation campaigns, but the simplicity of the injection vector necessitates immediate risk assessment and implementation of network-level controls.

Impact

Successful exploitation leads to unauthenticated remote code execution with the privileges of the NUMail application, potentially resulting in full server compromise, unauthorized access to email data, and lateral movement within the network.

Recommendation

• Perform an asset inventory to identify all instances of NUMail in the environment.
• Patch all affected NUMail installations as soon as a security update is provided by Green-Computing.
• Implement strict ingress filtering to limit access to NUMail management interfaces to trusted IP addresses only.
• Monitor web server access logs for anomalous characters (e.g., ;, |, &, $, `) in request parameters, which are typical indicators of command injection attempts.