The vulnerability CVE-2026-41113 affects sagredo qmail prior to version 2026.04.07. It is classified as CWE-78, indicating improper neutralization of special elements used in an OS command, commonly known as OS command injection. The issue arises from the use of the popen function in the notlshosts_auto function within the qmail-remote.c source file. This unsafe use allows an attacker to execute arbitrary code remotely through the tls_quit functionality. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No patch or official remediation level has been provided by the vendor, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full compromise including confidentiality, integrity, and availability impacts. The high CVSS score reflects the critical nature of this remote code execution vulnerability. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the affected service and applying any available workarounds recommended by the vendor once published. Avoid exposing the vulnerable component to untrusted networks if possible.