Live › vulnerability › CVE-2026-113403
Go to dashboardArmorX Spam, an email spam filter from ArmorX Global Technology, has a command injection flaw in one parameter. An logged-in attacker can send crafted input that runs commands and uploads malicious code to the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted ArmorX Spam (ArmorX Global Technology email spam filter) installs older than 8.15.2-3.282.133-1.90.061. An attacker needs a valid login, then sends crafted input in one unnamed parameter to run commands and upload malicious code on the server. Teams not running ArmorX Spam, or whose accounts are tightly restricted, can skip it, though the sibling CVE-2026-113402 is fixed in the same update.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArmorX Spam | vendor | < 8.15.2-3.282.133-1.90.061 | 8.15.2-3.282.133-1.90.061 |
8.15.2-3.282.133-1.90.061 is affectedUpdate ArmorX Spam to 8.15.2-3.282.133-1.90.061 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-113403")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.