Is CVE-2026-123620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123620 being exploited in the wild.

How severe is CVE-2026-123620?

High severity, with a CVSS score of 7.5, published 6 November 2026.

Is there a fix for CVE-2026-123620?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-123620 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123620?

Check whether you run Webmin Usermin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123620: Usermin command injection in Read Mail module

CVE-2026-123620 · Severity: high · CVSS 7.5 · Published 2026-11-06

Usermin is a webmail and system administration interface that allows users to manage email and other services. Through version 2.570, authenticated users can inject shell commands into IMAP folder names, which are executed when those folders are deleted in the web interface. This allows attackers with valid accounts to run arbitrary system commands with the privileges of their user account.

Vendors: Webmin.

Quick answers

Is CVE-2026-123620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123620 being exploited in the wild.
How severe is CVE-2026-123620?: High severity, with a CVSS score of 7.5, published 6 November 2026.
Which products and versions are affected?: Webmin Usermin through 2.570.
Is there a fix for CVE-2026-123620?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123620 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123620?: Check whether you run Webmin Usermin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the Read Mail module's handling of IMAP folder names. The vulnerability arises from unsanitized folder names passed to shell commands during folder deletion operations. An authenticated attacker can create a folder with shell metacharacters via an external IMAP client, then trigger command execution through the Usermin delete operation, allowing code execution as the authenticated user.

Affected products

Webmin Usermin through 2.570

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.