Which versions of SmarterMail are affected by CVE-2026-23760?

SmarterMail prior to build 9511 allows unauthenticated remote attackers to seize administrative control of mail servers and execute arbitrary commands at the OS level, impacting any organization…

Is there a public PoC exploit available for CVE-2026-23760?

Yes, a public proof-of-concept exploit is available for CVE-2026-23760. Prioritise patching immediately. EPSS: 65.4%.

How to fix or mitigate CVE-2026-23760?

Within 24 hours, inventory all SmarterMail deployments and identify those prior to build 9511; restrict network access to authorized users and disable internet-facing exposure if operationally feasible. Within 7 days, implement firewall rules blocking the /api/password-reset endpoint, enable detailed logging of authentication and administrative account changes, and deploy WAF rules to inspect and filter password reset API traffic. Within 30 days, monitor SmarterTools security advisories for available patches, prepare patch deployment procedures for testing and production environments, conduct forensic review of all administrative account logs to identify unauthorized access during the interim period, and execute patching once vendor releases become available.

SmarterMail CVE-2026-23760

Q: What is the CVSS score of CVE-2026-23760?

CVE-2026-23760 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 65.4%.

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-22 disclosure@vulncheck.com

Authentication Bypass Smartermail

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote, low-complexity, unauthenticated (PR:N/UI:N) auth bypass yielding full admin then OS command execution on the host, justifying S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 05:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 05:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Added to CISA KEV

Jan 27, 2026 - 16:16 cisa

CISA KEV

PoC Detected

Jan 27, 2026 - 16:16 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 15:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

AnalysisAI

Full administrative takeover of SmarterTools SmarterMail (builds prior to 9511) is possible because the force-reset-password endpoint of the password reset API accepts anonymous requests and skips verification of the current password or a reset token for system administrator accounts. A remote unauthenticated attacker who knows or guesses an admin username can set an arbitrary new password and seize the system administrator role, which in SmarterMail permits OS command execution and therefore SYSTEM/root-level control of the host. This is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and the EPSS score of 65.41% (98th percentile) reflects high near-term exploitation likelihood.

Technical ContextAI

SmarterMail is a Windows-oriented commercial mail server (SMTP/IMAP/POP/webmail plus a web-based management console) from SmarterTools. The flaw sits in the AuthenticationService.ForceResetPassword server-side API method exposed by the application. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the endpoint provides an alternate password-reset path that fails to enforce the authentication and ownership checks (existing password or valid reset token) that the normal reset flow requires - and critically applies this gap to privileged system administrator accounts. The affected component is identified by CPE cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* (all versions before build 9511). Because SmarterMail's admin role includes built-in management functionality that can run operating-system commands, an auth bypass at the admin tier escalates directly into remote code execution on the underlying server.

RemediationAI

Vendor-released patch: SmarterMail build 9511 - upgrade all SmarterMail instances to build 9511 or later immediately, confirming the version via the release notes at https://www.smartertools.com/smartermail/release-notes/current. Given confirmed active exploitation, treat any unpatched internet-facing instance as potentially already compromised: after upgrading, rotate all system administrator credentials, review admin accounts for unauthorized additions or password changes, and inspect the host for signs of OS command execution or persistence. If immediate patching is not feasible, restrict network access to the SmarterMail web/management interface - place it behind a VPN or IP allowlist and block untrusted access to the management endpoints so the anonymous force-reset-password call cannot be reached (trade-off: this also limits legitimate remote administration and, if applied to webmail, user access). Cross-reference the Huntress (https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce) and watchTowr (https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/) writeups for indicators of compromise to hunt for prior exploitation.