Which versions of NUMail are affected by CVE-2026-82082?

Green-Computing NUMail contains a critical unauthenticated command injection vulnerability (CVE-2026-82082, CVSS 9.3) enabling remote attackers to execute arbitrary operating system commands on mail…

How to fix or mitigate CVE-2026-82082?

Within 24 hours: Complete inventory of all Green-Computing NUMail deployments and affected versions; implement network access controls to restrict unauthenticated connections to NUMail services from external networks and untrusted segments. Within 7 days: Deploy intrusion detection and web application firewall rules specifically targeting OS command injection patterns against NUMail; enable logging and alerting for suspicious process execution on mail server hosts; conduct threat modeling on exposed instances. Within 30 days: Monitor Green-Computing security advisories for patch release; establish and test upgrade procedures in non-production environments; coordinate with business stakeholders on maintenance windows and develop rollback procedures for production deployments.

NUMail CVE-2026-82082

Q: What is the CVSS score of CVE-2026-82082?

CVE-2026-82082 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.5%.

EUVD-2026-67401 CRITICAL

OS Command Injection (CWE-78)

2026-08-28 twcert

GHSA-mwjg-762w-wg4x

Command Injection Numail

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote command injection with no user interaction gives AV:N/AC:L/PR:N/UI:N, and arbitrary OS command execution yields full C:H/I:H/A:H on an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 05:15 vuln.today

CVE Published

Aug 28, 2026 - 03:12 cve.org

CRITICAL 9.3

DescriptionCVE.org

NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

AnalysisAI

Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The affected NUMail instance must be network-reachable by the attacker (AV:N), and per the description exploitation is possible by unauthenticated remote attackers (PR:N) with no user interaction (UI:N) against the exposed service - no special product feature toggle or non-default configuration is named in the source data as a prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This should be treated as a high-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data, so verify and apply the fixed release referenced in the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11145-5361d-2.html and https://www.twcert.org.tw/tw/cp-132-11144-45c6a-1.html) as the primary remediation, using the exact version specified there once obtained. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Complete inventory of all Green-Computing NUMail deployments and affected versions; implement network access controls to restrict unauthenticated connections to NUMail services from external networks and untrusted segments. …

Threat intelligence, references, and detailed analysis are available after sign-in.