CVE-2026-23760criticalunder attackransomwareCWE-288

CVE-2026-23760: critical vulnerability in SmarterTools SmarterMail

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

Published · Updated

Follow this CVE+ Monitor SmarterMail

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 96%
from disclosure to weapon1 day
Published on NVDJan 22
1st PoC+1d
CISA KEV+4d
Action required by CISAfederal deadline: 2026-02-16

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SmarterMail versions before build 9511 allow anyone to reset administrator passwords without authentication, giving attackers complete control over the email server and the computer it runs on.

Technical detail

The password reset API endpoint accepts unauthenticated requests and lacks token or password verification for administrator accounts, enabling an attacker to supply a target username and new password to achieve full administrative compromise. SmarterMail admin privileges permit OS command execution, effectively granting SYSTEM/root access on the host.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
SmarterTools · SmarterMail
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SmarterTools SmarterMail

In the same product, most dangerous first.

CVE-2026-24423CRITICALSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APIEPSS 88.2%KEVCVE-2025-52691CRITICALUpload Arbitrary FilesEPSS 85.7%KEVCVE-2026-26930HIGHCVE-2026-26930EPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%