NUMail has a critical OS Command Injection vulnerability affecting all versions; update to 202602162 or later and restrict exposure until patched.
An OS Command Injection vulnerability has been disclosed in NUMail developed by Green Computing, identified as CVE-2026-82082 and corresponding to TWCERT TVN-202608011. The advisory states that its CVSS score is 9.8 (Critical), indicating a high-risk severity level, and that the affected product scope covers all versions of NUMail.
The core risk of this vulnerability is that an unauthenticated remote attacker can inject arbitrary operating system commands and execute them on the server. From an attack surface perspective, this means the weakness exists in a service processing flow directly accessible over the network. Once exploited, the attacker does not need to obtain an account or password before executing commands on the host.
The advisory also states that the vendor has completed the vulnerability fix, and users should apply the Patch update to version 202602162 or later. The vulnerability advisory was publicly released on 2026-08-28.
The essence of OS Command Injection is that when an application concatenates external input into system commands, it fails to properly filter or restrict special characters and parameters, causing the single command originally intended to be executed to be expanded by the attacker into additional commands. Although the advisory does not disclose the full code path, it clearly identifies the issue type as OS Command Injection and states that arbitrary operating system commands can be executed on the server, which is sufficient to infer that the vulnerability lies in the server-side command handling mechanism.
From the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scoring vector, the vulnerability is network-reachable, low complexity, requires no privileges, and needs no user interaction, while potentially causing high impact to confidentiality, integrity, and availability. This combination usually means that once the vulnerability is reliably exploited, the consequences may extend beyond a single command execution to system information disclosure, configuration tampering, service disruption, or even a foothold for subsequent lateral movement.
It is worth noting that the advisory does not provide more detailed attack flow, parameter names, affected endpoints, or verification steps, so one should not infer a specific exploitation chain or equate this vulnerability with any particular existing attack framework. For technical operations personnel, the most practical basis for judgment remains whether an affected version is deployed and whether the system has been updated to patch version 202602162 or later.
The affected product in this incident is all versions of NUMail. Since the advisory does not further distinguish submodules, deployment types, or specific version ranges, risk assessment should first treat all versions as requiring review.
In real-world scenarios, if NUMail is deployed in an externally accessible mail environment, an attacker may directly send requests from the internet; if the system is located on an internal network, lateral exploitation risk after a compromised internal host must still be considered. Because the vulnerability allows arbitrary operating system command execution, the impact is not limited to the application itself but also includes the host's privilege level, file read/write scope, and the permission boundaries of related service accounts.
For enterprises, the spillover effect of this kind of vulnerability is usually greater than that of a single application issue. If NUMail is integrated with an account system, mail database, or notification workflow, once an attacker gains command execution capability, they may be able to access sensitive settings, email content, or credential-related information through local privileges. Although the advisory does not describe any actual exploitation cases, the inherent risk should be treated as a critical incident.
The primary measure is to immediately verify the NUMail version and apply the vendor-provided patch version 202602162 or later as soon as possible. This is the only explicit and direct mitigation stated in the advisory and should be treated as the top patching priority.
Before the update is completed, the exposed attack surface and reachability should be reduced to avoid exposing the NUMail service to unnecessary external networks. If operating conditions allow, only necessary sources should be granted access, and the management interface, service interface, and general user entry points should be clearly separated.
At the same time, signs of abnormal command execution on the server should be checked, such as unexpected process launches, unusual child-process chains, sudden spikes in system tool invocations, and unreasonable operations performed by service accounts. Since the advisory states that arbitrary operating system commands can be executed on the server, any behavior that deviates from normal operating patterns should be included in incident investigation.
If the environment already has security monitoring, centralized logging, and host protection mechanisms, the NUMail host should be listed as a priority monitoring target, and system and application logs before and after the update should be retained for later comparison to determine whether suspicious access or command injection traces occurred. Although this does not replace patching, it can improve detection and investigation capabilities.