{"id":"CVE-2026-113403","kind":"vulnerability","aliases":["CVE-2026-113403"],"related":[],"title":"ArmorX Spam: authenticated command injection lets attackers upload malicious code","description":"ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.","summary":"ArmorX Spam, an email spam filter from ArmorX Global Technology, has a command injection flaw in one parameter. An logged-in attacker can send crafted input that runs commands and uploads malicious code to the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ArmorX Spam","fixed":["8.15.2-3.282.133-1.90.061"],"affected":"< 8.15.2-3.282.133-1.90.061","ecosystem":"vendor"}],"ecosystems":[],"tags":["armorx-spam","email-gateway","infrastructure","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Check the installed ArmorX Spam version in the appliance admin console/about page; any version older than 8.15.2-3.282.133-1.90.061 is affected. Also limit and review who has logins to the admin interface.","fix":"Update ArmorX Spam to 8.15.2-3.282.133-1.90.061 or later.","status":"open","published_at":"2026-10-20T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:45+00:00","updated_at":"2026-10-25T03:37:59+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:34:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ArmorX Spam: authenticated command injection lets attackers upload malicious code","impact":"high","summary":"ArmorX Spam, an email spam filter from ArmorX Global Technology, has a command injection flaw in one parameter. An logged-in attacker can send crafted input that runs commands and uploads malicious code to the server.","category":"infrastructure","nicknames":[],"who_cares":["armorx-spam","self-hosted","email-gateway"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker runs commands and uploads malicious code on the server","analyst_note":"Find the vendor advisory or affected version range for ArmorX Spam and the name of the vulnerable parameter; the NVD entry alone gives no versions or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000512,"input_tokens":3286,"output_tokens":366,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or affected version range for ArmorX Spam and the name of the vulnerable parameter; the NVD entry alone gives no versions or fix.","search":"'-113403':13A,16A '-2026':12A,15A 'armorx':1A,17A,20B,29B,36B,66C,70C 'armorx-spam':19B 'attack':7A,51B,80C 'authent':3A,78C 'code':10A,62B,92C 'command':4A,41B,58B,75C,84C 'craft':54B,83C 'cve':11A,14A 'develop':68C 'email':23B,32B 'email-gateway':22B 'filter':34B 'flaw':43B 'gateway':24B 'global':37B,71C 'host':28B 'infrastructur':25B 'inject':5A,42B,76C,82C 'input':55B 'let':6A 'log':49B 'logged-in':48B 'malici':9A,61B,91C 'one':45B 'paramet':46B,88C 'remot':79C 'run':57B 'self':27B 'self-host':26B 'send':53B 'server':65B,95C 'spam':2A,18A,21B,30B,33B,67C 'specif':87C 'technolog':38B,72C 'therebi':89C 'upload':8A,60B,90C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ArmorX Spam (ArmorX Global Technology email spam filter) installs older than 8.15.2-3.282.133-1.90.061. An attacker needs a valid login, then sends crafted input in one unnamed parameter to run commands and upload malicious code on the server. Teams not running ArmorX Spam, or whose accounts are tightly restricted, can skip it, though the sibling CVE-2026-113402 is fixed in the same update.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113403","severity":null,"published_at":"2026-10-20T07:17:09+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113403:760","url":null,"severity":null,"published_at":"2026-10-25T03:37:59+00:00","modified_at":"2026-10-25T03:37:59+00:00","first_seen_at":"2026-10-25T03:37:59+00:00","fetched_at":"2026-10-25T03:37:59+00:00","note":"TWCERT/CC TVN-202610004 (CNA, not vendor page): affected < 8.15.2-3.282.133-1.90.061, fixed in that version; parameter name not public; no PoC/exploitation found; sibling CVE-2026-113402 (LFI) same release. Not marked verified: no ArmorX vendor page read."}],"documents":[{"id":3256,"url":"https://www.twcert.org.tw/en/cp-139-11295-f2efd-2.html","title":"TWCERT/CC TVN-202610004: ArmorX Spam - 2 Vulnerabilities","kind":"advisory","source":"analyst","text":"TVN-202610004. CVE-2026-113402, CVE-2026-113403. Affected: ArmorX Spam versions prior to 8.15.2-3.282.133-1.90.061. Solution: update to 8.15.2-3.282.133-1.90.061 or later. CVE-2026-113403 command injection, authenticated remote attackers inject crafted commands into a specific parameter, uploading malicious code. Credit: Cyku Hong (DEVCORE). Public date 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3257,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113403","title":"CVE Record CVE-2026-113403","kind":"other","source":"analyst","text":"CNA twcert. CWE-93. Affected from 0 before 8.15.2-3.282.133-1.90.061. CVSS 4.0 7.1, 3.1 6.5 (PR:L).","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}