CVE-2025-52691criticalunder attackransomwareCWE-434

CVE-2025-52691: critical vulnerability in SmarterTools SmarterMail

Upload Arbitrary Files

Published · Updated

Follow this CVE+ Monitor SmarterMail

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 86%
from disclosure to weaponsame day
Published on NVDDec 29
1st PoCDec 29
metasploitOct 9
CISA KEV+28d
Action required by CISAfederal deadline: 2026-02-16

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An attacker can upload any file to a mail server without logging in, which could let them run malicious code on the server. This is a critical flaw because it gives complete control to attackers.

Technical detail

This CWE-434 vulnerability allows unauthenticated arbitrary file upload to the mail server filesystem without proper validation or access controls. Successful exploitation enables remote code execution by uploading malicious scripts or binaries to executable paths, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
SmarterTools · SmarterMail
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SmarterTools SmarterMail

In the same product, most dangerous first.

CVE-2026-23760CRITICALSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APIEPSS 96.4%KEVCVE-2026-24423CRITICALSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APIEPSS 88.2%KEVCVE-2026-26930HIGHCVE-2026-26930EPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%