EUVD-2026-67401
GHSA-mwjg-762w-wg4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing NUMail server
-
DeliverySend request with shell metacharacters
-
ExploitInjected input reaches OS command interpreter
-
ExecutionArbitrary commands execute as mail service
-
ImpactFull host compromise and data theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected NUMail instance must be network-reachable by the attacker (AV:N), and per the description exploitation is possible by unauthenticated remote attackers (PR:N) with no user interaction (UI:N) against the exposed service - no special product feature toggle or non-default configuration is named in the source data as a prerequisite. The primary limiting factor is network exposure: an instance restricted to internal or VPN-only access is not reachable by external attackers, substantially reducing practical risk. The exact vulnerable endpoint or input parameter is not specified in the available data, so the precise request needed to trigger the injection is not confirmed. |
| Impact | This should be treated as a high-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity exploitation with no authentication and no user interaction, and the impact metrics (VC:H/VI:H/VA:H) indicate full compromise of the affected system - a profile that is trivially automatable and attractive for opportunistic scanning once details circulate. Countering that, no EPSS score, POC, or KEV entry is present in the input, so there is currently no confirmed real-world exploitation; the risk here is driven by the intrinsic severity of a pre-auth RCE rather than observed activity. Because the advisory originates from TWCERT, exposure may skew toward the vendor's regional (Taiwan) install base, but any internet-facing NUMail instance is directly reachable, so operators of even mid-sized deployments should patch or restrict access promptly rather than wait for exploitation reports. |
| Exploit ScenarioDerived | An attacker locates an internet-facing NUMail server and sends a crafted request to a vulnerable endpoint containing shell metacharacters in a parameter that the application passes to an OS command. The injected command executes with the mail service's privileges, giving the attacker a foothold to read mailbox data, tamper with mail, or pivot deeper into the network. Because exploitation requires no authentication and low complexity (AV:N/AC:L/PR:N/UI:N), it can be scripted for mass scanning, though no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Unauthenticated OS command injection in Green-Computing NUMail lets remote attackers execute arbitrary operating-system commands on the underlying mail server host. The CVSS 4.0 score of 9.3 reflects network reach with no privileges or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth access and command execution makes it a high-priority patch target.
RemediationAI
No vendor-released patch version is identified in the available data, so verify and apply the fixed release referenced in the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11145-5361d-2.html and https://www.twcert.org.tw/tw/cp-132-11144-45c6a-1.html) as the primary remediation, using the exact version specified there once obtained. Until a confirmed patch is applied, reduce exposure by removing the NUMail service from direct internet reachability - place it behind a VPN or restrict inbound access to trusted management networks and known mail peers via firewall or reverse proxy (trade-off: may disrupt legitimate remote client or inter-server mail flows and requires an allowlist of expected senders). Additionally, monitor the mail service host for anomalous child processes spawned by the mail daemon and unexpected outbound connections as a detective control, since these can reveal exploitation attempts even with mitigations in place.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NUMail is an email server product from the Taiwanese vendor Green-Computing (CPE cpe:2.3:a:green-computing:numail). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-controlled input reaches a shell or command interpreter without adequate sanitization or parameterization. In mail-server contexts this class of bug typically arises when user-supplied values (SMTP/webmail parameters, message fields, or administrative inputs) are concatenated into system calls, allowing shell metacharacters to break out and run additional commands with the privileges of the mail service process.
Know when Numail gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated remote command injection with no user interaction gives AV:N/AC:L/PR:N/UI:N, and arbitrary OS command execution yields full C:H/I:H/A:H on an unchanged scope.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
DescriptionCVE.org
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
Executive ViewAI
Green-Computing NUMail contains a critical unauthenticated command injection vulnerability (CVE-2026-82082, CVSS 9.3) enabling remote attackers to execute arbitrary operating system commands on mail server infrastructure. No public exploit has been identified at time of analysis, but the lack of authentication requirements and potential for full system compromise make this a severe organizational risk affecting email infrastructure availability and data confidentiality. Immediate containment measures are required as no vendor patch is currently available.
Implement strict network segmentation restricting NUMail access to trusted administrative and internal networks only; deploy web application firewall with rules blocking OS command injection patterns; enable continuous monitoring of all NUMail-related network traffic and process execution for anomalies; consider temporary service isolation or air-gapping of NUMail infrastructure until vendor patches are released; maintain detailed audit logs of all administrative access and configuration changes to NUMail systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB