CVE-2026-82082: NUMail OS Command Injection RCE Vulnerability

CVE-2026-82082 Overview

CVE-2026-82082 is an OS command injection vulnerability [CWE-78] affecting NUMail, a mail server product developed by Green-Computing. Unauthenticated remote attackers can inject arbitrary operating system commands and execute them on the underlying server. The vulnerability requires no privileges and no user interaction, making it exploitable across any network-reachable NUMail instance.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on the NUMail server, leading to full system compromise, data exfiltration, and lateral movement.

Affected Products

NUMail (developed by Green-Computing)
Specific affected versions have not been enumerated in the NVD record
Deployments exposed to untrusted networks are at highest risk

Discovery Timeline

2026-08-28 - CVE-2026-82082 published to NVD
2026-08-28 - Last updated in NVD database
Advisory - Coordinated via TW-CERT Security Advisory (English) and TW-CERT Security Advisory (Chinese)

Technical Details for CVE-2026-82082

Vulnerability Analysis

The vulnerability is classified as an Improper Neutralization of Special Elements used in an OS Command [CWE-78]. NUMail processes attacker-controlled input and passes it to an operating system shell without adequate sanitization or argument separation. As a result, shell metacharacters embedded in the request are interpreted by the underlying command interpreter.

Because the flaw is reachable pre-authentication, an attacker only needs network access to the NUMail service. Successful exploitation grants command execution in the security context of the NUMail process, which typically has broad access to mail queues, configuration, and stored credentials.

Root Cause

The root cause is unsafe construction of shell command strings from untrusted input. When user-supplied data is concatenated into a command line and executed through functions such as system(), popen(), or equivalent shell invocations, metacharacters like ;, |, &, `, and $() break out of the intended argument context. Proper mitigation requires either strict allow-list validation or executing subprocesses with argument arrays that bypass the shell entirely.

Attack Vector

The attack vector is network-based (AV:N) and requires no authentication or user interaction. An attacker crafts a malicious request to an exposed NUMail endpoint containing shell metacharacters within a vulnerable input field. NUMail passes the input to a shell, which executes attacker-supplied commands. Refer to the TW-CERT advisory for vendor-provided technical details.

// No verified proof-of-concept has been published.
// See TW-CERT advisories for vendor-provided technical details.

Detection Methods for CVE-2026-82082

Indicators of Compromise

Unexpected child processes spawned by the NUMail service (for example, sh, bash, cmd.exe, powershell.exe, curl, wget, nc)
Outbound connections from the mail server host to unknown external IP addresses or download sources
New or modified files in mail server directories, web-accessible paths, or scheduled task locations
Anomalous entries in NUMail request or access logs containing shell metacharacters such as ;, |, &&, `, or $()

Detection Strategies

Deploy endpoint detection rules that flag the NUMail process launching interactive shells or scripting interpreters
Inspect HTTP and SMTP request payloads for shell metacharacters and encoded variants targeting mail server endpoints
Correlate mail server process activity with outbound network flows to identify command-and-control staging
Baseline normal NUMail child-process behavior and alert on deviations

Monitoring Recommendations

Forward NUMail application, web, and system logs to a centralized SIEM for retention and correlation
Monitor for privilege escalation attempts and modifications to system persistence mechanisms following mail service activity
Track EPSS trajectory for CVE-2026-82082, which currently sits in the 72nd percentile, indicating meaningful exploitation probability
Alert on any process tree in which the NUMail service is the parent of a shell or network utility

How to Mitigate CVE-2026-82082

Immediate Actions Required

Restrict network access to NUMail management and vulnerable endpoints using firewall rules or network segmentation
Contact Green-Computing and consult the TW-CERT advisory for the current fixed version and apply it as soon as available
Audit NUMail hosts for signs of prior exploitation, including unauthorized processes, files, and outbound connections
Rotate credentials and secrets stored on or accessible from affected servers if compromise is suspected

Patch Information

Refer to the vendor coordination advisories published by TW-CERT for patch details and fixed versions: TW-CERT Security Advisory (English) and TW-CERT Security Advisory (Chinese). At the time of publication, no dedicated vendor advisory URL beyond the TW-CERT coordination pages is listed in the NVD entry.

Workarounds

Place NUMail behind a reverse proxy or web application firewall configured to block shell metacharacters in request parameters
Limit exposure of NUMail interfaces to trusted management networks or VPN-only access until a patch is applied
Run the NUMail service under a least-privilege account to reduce the blast radius of successful command execution
Enable host-based application allow-listing to prevent the NUMail process from launching shells or scripting interpreters

bash

# Example: restrict NUMail administrative access to a trusted management subnet
iptables -A INPUT -p tcp --dport 25 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP