High-Risk OS Command Injection Vulnerability in Usermin Disclosed
Article Content
- •CVE-2026-123620 allows OS command injection in Usermin 2.570.
- •Authenticated users can exploit the flaw via crafted IMAP folder names.
- •Immediate patching is recommended due to the high risk of exploitation.
An OS command injection vulnerability (CVE-2026-123620) has been identified in Usermin version 2.570, affecting its Read Mail module. This flaw allows authenticated users to execute arbitrary commands by exploiting unsanitized IMAP folder names. Attackers can create folders with shell metacharacters via external IMAP clients, then delete them through Usermin to execute commands with the privileges of the Usermin process. The vulnerability poses a high risk, particularly for internet-facing deployments where users can manage IMAP folders. Although there is no evidence of active exploitation at this time, the potential impact includes compromising confidentiality, integrity, and availability on the host system. Users are advised to upgrade to a patched version promptly and restrict access to the affected functionality until then. The CVSS score for this vulnerability is 7.7, classified as high risk.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CVE-2026-123620 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of Usermin are affected?
Is there any active exploitation reported?
What should I do to mitigate this risk?
Continue Reading
North Korean Hackers Steal $6.3 Billion from Binance in Coordinated Attack On October 29, 2026, Binance suffered a large cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in cryptocurrency. The attackers gained initial access through social engineering tactics, including a fake job offer that led to malware… 
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…