Pusula Expert Mail CVE-2026-82924

Exploitation requires the Expert Mail authentication interface (e.g., webmail/login endpoint) to be network-reachable by the attacker, and depends on the server not enforcing lockout, CAPTCHA, or request-throttling on repeated login attempts - which is the core defect. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are needed, and default-configuration instances are affected. Limiting factors: the attack only yields results against weak or guessable credentials, impact is confined to confidentiality (C:L), and any compensating controls such as a WAF, external MFA, IP rate limiting, or network segmentation in front of the login surface materially reduce feasibility.

This is a moderate-severity (CVSS 5.3) rate-limiting/anti-automation weakness (CWE-799, Improper Control of Interaction Frequency) enabling brute-force attacks against Pusula Expert Mail. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is remotely reachable, low-complexity, and requires no privileges or user interaction, which is consistent with an exposed authentication endpoint lacking throttling. However, impact is constrained: C:L/I:N/A:N means only limited confidentiality exposure (e.g., successful credential guessing or account enumeration) with no direct integrity or availability loss, so the vulnerability is an enabler of credential compromise rather than a direct code-execution or data-breach flaw. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization - this reads as a real-but-not-urgent hardening issue rather than a top-priority emergency. Note a mild tension to verify: the CVE is categorized as 'Brute Force' / improper interaction frequency, yet carries an 'Information Disclosure' tag and C:L impact; the realistic consequence is that absence of rate limiting makes password-guessing or user-enumeration feasible, so treat the confidentiality impact as downstream of brute forcing, not a standalone disclosure bug.

A remote, unauthenticated attacker scripts a high-volume password-guessing or credential-stuffing campaign against the Expert Mail login interface, which fails to limit authentication attempt frequency. With enough attempts the attacker guesses valid credentials or enumerates existing accounts, gaining a foothold into targeted mailboxes. No public exploit code was identified at time of analysis; the attack requires only standard automation tooling given the low attack complexity.