VulnSocial

CVE-2026-93012Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-09-21); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-21: 1Mentions · 2026-09-23: 1Mentions · 2026-10-11: 1Patch / Workaround · 2026-09-21: 1Patch / Workaround · 2026-09-23: 1Patch / Workaround · 2026-10-11: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-23: 1Technical Details · 2026-10-11: 109-2109-2310-11
Signal classification1 categories
Patch
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • CVE@CVEnew
    Patch

    CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the sh… https://www.cve.org/CVERecord?id=CVE-2026-93012

    Post summary

    The text describes CVE-2026-93012 in Perl's Email::Sender::Transport::Sendmail before version 2.602, enabling arbitrary command execution on Windows. No PoC, exploit tool, or active exploitation is indicated, but the version boundary implies a fix in 2.602.

    000211.1K
    58.2K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-93012: Email::Sender::Transport::Sendmail before 2.602 lets envelope addresses reach the shell on Windows, enabling command execution. CVSS 9.8. Patch available. Update now. https://www.valtersit.com/cve/CVE-2026-93012 #CVE #Perl #infosec #EmailSender #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text describes a command-execution vulnerability in Email::Sender::Transport::Sendmail before version 2.602 and states that a patch is available. No PoC, named exploit tool, or active exploitation is reported.

    0000053
    1.1K followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🪟 CVE-2026-93012: Email::Sender::Transport::Sendmail for Perl (versions before 2.602) allows arbitrary command execution on Windows via crafted envelope addresses in _sendmail_pipe. Patch to 2.602. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-93012?utm_campaign=x https://t.co/BijU0zAttA

    Post summary

    The tweet discloses CVE-2026-93012 in Perl's Email::Sender::Transport::Sendmail (versions <2.602) allowing arbitrary command execution on Windows via crafted envelope addresses, and advises patching to version 2.602.

    00000174
    892 followersView on X

Explore more

Back to dashboard