Mail Assure
Monthly
Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis.
Cross-tenant SMTP sender spoofing in N-able Mail Assure (all versions through April 2026) permits any authenticated tenant to specify arbitrary MAIL FROM envelope addresses - including domains belonging to other co-hosted tenants - without the relay enforcing any domain-to-account ownership binding. Because the shared relay is itself listed in the SPF records and DMARC policy of every hosted tenant domain, spoofed outbound messages pass SPF and DMARC validation at recipient mail servers, giving the attack the appearance of fully authorized email. N-able has publicly stated this is intended behavior of its shared relay architecture, making no vendor patch expected. A researcher demonstration gist has been published, and no public exploit or CISA KEV listing exists at time of analysis.