N-able Mail Assure CVE-2025-68624

Requires possession of a valid SMTP AUTH credential for any tenant account on the N-able Mail Assure shared relay - exploitation is limited to authenticated tenants (PR:L); unauthenticated external actors and users without a Mail Assure account cannot exploit this. No elevated tenant privilege, administrative access, or non-default configuration is required beyond basic sending access. The attacker must know or guess a target tenant's domain name (trivially discoverable through MX/SPF/DMARC DNS records or public sources). Exploitation is constrained to envelope sender spoofing (MAIL FROM); the attack does not grant access to victim tenant mail data, account settings, or system resources. Recipient servers enforcing strict SMTP envelope inspection beyond SPF/DMARC (e.g., S/MIME signing, custom header validation, or relay-source allowlisting) may partially mitigate the deception but would not prevent message delivery.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures the authentication requirement and limited direct integrity impact in metric terms, but meaningfully understates the real-world phishing and business email compromise (BEC) exposure enabled by the SPF/DMARC bypass - even a mid-sized municipal IT team in gliwice hosting their domain through an MSP's Mail Assure deployment could find their brand silently weaponized by a co-hosted malicious tenant to send DMARC-passing phishing campaigns targeting their own clients. No EPSS data is included in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no automated exploit framework is documented, but the attack requires only basic SMTP knowledge and a valid tenant credential - low technical barrier. The researcher gist reference (https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92) appears to demonstrate the behavior but is not labeled as a POC in NVD data. The vendor's explicit acceptance of this as intended behavior is the most significant risk-amplifying signal: there will be no remediation from the vendor side, and tenants must independently mitigate or migrate.

An attacker who is a legitimate Mail Assure tenant in good standing connects to the shared SMTP relay's TCP port, performs SMTP AUTH with their own valid credentials, and issues a MAIL FROM command specifying a victim co-hosted tenant's domain. The relay accepts the message without validating domain ownership and delivers it to external recipients, where the message passes SPF and DMARC checks because the relay infrastructure is the authorized sender for all hosted domains. The attack requires no special tooling - standard SMTP client commands suffice, and the researcher gist appears to provide a concrete demonstration.