CVE-2026-82082: Critical Unauthenticated OS Command Injection in NUMail

Overview

A critical OS command injection vulnerability has been disclosed in NUMail, an email system product from Taiwan-based email-security vendor Green-Computing (綠色運算股份有限公司). Tracked as CVE-2026-82082 and rated CVSS 9.8 (Critical), the flaw allows unauthenticated remote attackers to inject and execute arbitrary operating system commands directly on the server hosting NUMail.

Green-Computing is best known for its Nopam line of email-security tools (antispam, mail DLP, email archiving, load balancing), and NUMail is marketed as its "new generation" mail system offering. The vulnerability was published simultaneously by NVD and TWCERT/CC, Taiwan's national CERT, as Taiwan Vulnerability Note TVN-202608011, on 2026-08-28.

The combination of no authentication requirement, no user interaction, network attack vector, and full impact to confidentiality, integrity, and availability makes this one of the more severe advisory classes possible — a single unauthenticated request can result in full server compromise.

Technical Details

How It Works

Neither the NVD entry nor the TWCERT/CC advisory publishes the specific vulnerable endpoint, parameter, or code path — this is typical for a coordinated-disclosure advisory where the finder credits the vendor rather than a detailed technical write-up. What is confirmed is the vulnerability class: CWE-78, OS Command Injection. In products of this type, that pattern almost always means user-supplied input from an HTTP request (a form field, header, or API parameter reachable without login) is passed into a shell command or system call without adequate sanitization, letting an attacker append shell metacharacters (;, &, |, &&, `, or $()) to smuggle additional commands.

The critical detail from the advisory is that no authentication is required to reach the vulnerable code path. Combined with a network attack vector and no user interaction, this means the flaw is reachable by any party that can send traffic to the exposed NUMail service — a hallmark profile for pre-authentication remote code execution.

As of this writing, no public proof-of-concept or exploit code has been identified, and there is no indication in NVD, TWCERT/CC, or CISA's Known Exploited Vulnerabilities catalog that this flaw is being actively exploited in the wild.

Impact Assessment

Who Is At Risk

• Any organization running NUMail from Green-Computing, on any version prior to the patched build
• Given NUMail's role as a mail system, instances are commonly exposed to the internet by design (SMTP/webmail front ends), which raises the practical exposure of an unauthenticated, network-reachable flaw
• Organizations in Green-Computing's primary market (Taiwan) are likely the largest deployment base, but the product is not geographically restricted

Potential Impact

A successful exploit gives an attacker arbitrary command execution in the context of the NUMail server process. Depending on how the service is deployed, that can translate to:

• Full compromise of the mail server host, including any mailbox data, credentials, or configuration stored on it
• A pivot point into the surrounding network if the mail server has trusted internal access
• Use of the compromised mail infrastructure for further phishing, spam, or lateral-movement campaigns

Mitigation

Immediate Actions

• Upgrade to NUMail build 202602162 or later. TWCERT/CC's advisory states the vendor has already released a fix and lists this build as the remediated version — confirm the exact build/version numbering directly with Green-Computing before relying on this figure for a compliance record.
• Restrict network exposure of the NUMail service to trusted networks or a VPN wherever the deployment allows it, as an interim measure while patching is scheduled.
• Review server and application logs for unexpected process spawns, unfamiliar outbound connections, or new files/scripts written by the NUMail service account, in case exploitation occurred before patching.
• Treat any credentials or secrets stored on or accessible from the NUMail host as potentially exposed if the server was internet-facing and unpatched.

No official workaround beyond patching has been published by the vendor or TWCERT/CC. Given the unauthenticated, network-exploitable nature of the flaw, patching should be treated as urgent rather than scheduled into routine maintenance windows.

Detection Opportunities

• Monitor for anomalous child processes spawned by the NUMail service (shells, interpreters, or unexpected binaries) — a strong signal of command-injection exploitation
• Alert on outbound connections initiated from the mail server host that do not match normal mail-delivery or update traffic patterns
• Watch for newly created web shells or scripts dropped into the NUMail web root or working directories
• Since no public PoC exists yet, defenders should prioritize generic command-injection detections (unusual shell metacharacters in web request logs, unexpected sh/bash/cmd invocations) over signature-based rules

Background

CVE-2026-82082 was reported to TWCERT/CC — Taiwan's Computer Emergency Response Team/Coordination Center — and published as Taiwan Vulnerability Note TVN-202608011, crediting a researcher identified as "Jane" from Green-Computing itself. TWCERT/CC regularly coordinates disclosure for Taiwanese software vendors, including a number of mail and mail-security products (Openfind Mail2000, N-Partner's N-Reporter/N-Cloud/N-Probe, and others have received similar OS command injection advisories through the same program).

Unlike many of the higher-profile CVEs covered on this site, public technical detail here is genuinely thin: neither NVD nor TWCERT/CC has published the vulnerable component, request path, or a proof-of-concept, and no third-party security research firm appears to have independently analyzed the flaw as of publication. That is not unusual for regional CERT-coordinated advisories on lower-profile enterprise software, but it does mean defenders should rely on the CVSS vector and CWE classification — not on assumptions about the specific exploitation technique — when prioritizing remediation.

Organizations running NUMail should not wait for further technical detail to emerge before patching: an unauthenticated, network-exploitable, CVSS 9.8 command injection is a "patch now" finding regardless of how much of the underlying root cause has been made public.

References

• NVD — CVE-2026-82082
• TWCERT/CC — NUMail OS Command Injection Advisory (English)
• TWCERT/CC — NUMail OS Command Injection Advisory (Chinese, TVN-202608011)