ArmorX Spam contains a command injection flaw that permits authenticated remote attackers to supply a crafted value to a specific parameter. The unfiltered input is executed on the server, allowing the attacker to run arbitrary shell commands and upload malicious code. The weakness is documented as CWE‑93.

The vulnerable product is ArmorX Spam from ArmorX Global Technology. All releases prior to update 8.15.2‑3.282.133‑1.90.061 are affected. The patch moves the product to a secure implementation that sanitizes the parameter and enforces proper command execution policies.

The CVSS score of 7.1 indicates a high risk, while the EPSS score of less than 1 % points to a low likelihood of exploitation at present. The flaw is not in the CISA KEV catalog, but it remains exploitable by authenticated users reaching the vulnerable endpoint. An attacker could remotely trigger the injection via crafted HTTP requests, gaining full control over the affected server.