CVE-2026-82082

NUMail, a mail server product from Taiwan-based vendor Green-Computing, contains an OS command injection flaw (CWE-78) that allows an unauthenticated remote attacker to inject arbitrary operating system commands into server-side command calls. The flaw is reachable over the network with no privileges or user interaction required (CVSS 4.0 AV:N/PR:N/UI:N), so a single crafted request can trigger it. Successful exploitation yields execution of arbitrary commands on the underlying server, giving the attacker high-impact control over confidentiality, integrity, and availability of the host and the mail data it holds. Any organization running NUMail is affected; the vendor's advisory (coordinated by Taiwan's CERT, twcert) applies to deployments of this product and no specific unaffected version ranges are available in the current data. There is no public proof-of-concept and the flaw is not in CISA KEV; EPSS assigns a 1.5% chance of exploitation within 30 days (73rd percentile), indicating moderate but not yet observed exploitation risk.

What to do: Monitor the Green-Computing NUMail vendor advisory and the twcert (TVN/CVE-2026-82082) announcement for the patched version and apply the update as soon as it is released, since no fixed version is named in current data. In the meantime, restrict network access to NUMail's externally reachable services (firewall/ACL or VPN, allow-listing trusted sources) to reduce unauthenticated exposure, and check internet-exposed mail servers for signs of unexpected process or command execution. Given the 9.3 critical score and unauthenticated network vector, prioritize patching if NUMail is exposed to the internet.