SmarterMail CVE-2026-23760

The specific prerequisite is network reachability to the SmarterMail force-reset-password API endpoint (the AuthenticationService.ForceResetPassword method) on a build prior to 9511, plus knowledge of a valid system administrator username (commonly a default or easily guessed value such as 'admin'). No authentication, no existing password, no reset token, and no user interaction are required - the endpoint permits anonymous requests. The primary limiting factors are therefore only: the instance must be running a vulnerable build (< 9511), the web/management interface must be reachable by the attacker, and a targetable admin username must be supplied. No non-default configuration is needed; the weakness is present in the default reset flow.

All signals align toward top-priority, immediate patching. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high impact on confidentiality, integrity, and availability - no scope/subsequent-system change is scored, though the description's OS command execution capability arguably warrants subsequent-system impact. EPSS of 65.41% (98th percentile) indicates high statistical exploitation probability, and unusually it is corroborated rather than contradicted by hard evidence: the CVE is listed in CISA KEV as actively exploited and public exploit code exists (Huntress and watchTowr writeups). There is no conflict between the signals here - SSVC-style reasoning would rate exploitation=active, automatable=yes (network unauthenticated, deterministic), technical impact=total. This is a genuine emergency-class issue, not a high-CVSS-but-low-real-risk case. The only mild caveat is that successful exploitation presumes the SmarterMail web/management interface is reachable by the attacker, which internet-facing mail servers typically are.

An attacker enumerates internet-facing SmarterMail servers, sends an anonymous request to the force-reset-password API supplying a known or guessed system administrator username (e.g. 'admin') and a chosen new password, and the server resets the account without any token or current-password check. The attacker logs in as system administrator and uses SmarterMail's built-in management functionality to run operating-system commands, achieving RCE with SYSTEM/root privileges on the host. Public exploit code exists, and this technique is confirmed actively exploited in the wild per CISA KEV.