Authentication bypass in SmarterTools SmarterMail password reset API (CVE-2026-23760)

SmarterMail's AuthenticationService.ForceResetPassword endpoint accepts unauthenticated requests and does not verify an existing password or reset token when resetting system administrator account credentials. An unauthenticated remote attacker can supply an administrator username and an arbitrary new password to fully compromise the SmarterMail instance. Because SmarterMail system administrator privileges include the ability to execute operating system commands, successful exploitation results in administrative-level access on the underlying host. ⚠️ Actively exploited in the wild (CISA KEV). Affected versions: - SmarterMail < Build 9511 We recommend updating to: Build 9511. CVSS 9.3 · our assessment: emergency Reference: https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail Details: https://vuln.today/cve/CVE-2026-23760