What is the CVSS score of CVE-2026-23760?

CVE-2026-23760 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 65.4%.

Which versions of Smartermail are affected by CVE-2026-23760?

SmarterMail servers are vulnerable to complete administrative account takeover without authentication, allowing attackers to reset system administrator passwords and gain full control of email…

Is there a public PoC exploit available for CVE-2026-23760?

Yes, a public proof-of-concept exploit is available for CVE-2026-23760. Prioritise patching immediately. EPSS: 65.4%.

How to fix or mitigate CVE-2026-23760?

Within 24 hours: Isolate all SmarterMail servers from public internet access and implement emergency access controls; verify admin account integrity and review access logs for suspicious password reset activity. Within 7 days: Deploy WAF rules to block the force-reset-password endpoint or require authentication tokens; implement network segmentation to restrict API access to authorized networks only. Within 30 days: Upgrade to SmarterMail build 9511 or later when available; conduct forensic analysis of logs for unauthorized access; force password resets for all administrative accounts; implement multi-factor authentication for all admin accounts.

Smartermail CVE-2026-23760

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-22 disclosure@vulncheck.com

Authentication Bypass Smartermail

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Added to CISA KEV

Jan 27, 2026 - 16:16 cisa

CISA KEV

PoC Detected

Jan 27, 2026 - 16:16 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 15:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

AnalysisAI

SmarterTools SmarterMail prior to build 9511 contains a critical authentication bypass in the password reset API (CVE-2026-23760) that allows unauthenticated attackers to reset system administrator passwords without verification. With EPSS 65% and KEV listing, this trivially exploitable vulnerability enables complete email server takeover, compromising all hosted mailboxes and organizational communications.

Technical ContextAI

The password reset API endpoint in SmarterMail does not require authentication and does not validate the existing password or any reset token before changing the password of system administrator accounts. An attacker simply needs to know (or guess) the admin username and send a POST request to the force-reset-password endpoint with a new password. This is a design flaw rather than a subtle bug — the endpoint completely lacks authorization checks.

RemediationAI

Upgrade SmarterMail to build 9511 or later immediately. If unable to patch: restrict access to the management API to trusted IPs only via firewall. Audit admin accounts for unauthorized password changes. Review mail logs for suspicious access patterns. Change all admin passwords after patching.