Smartermail
Monthly
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token is redeemed at POST /api/v1/auth/refresh-token, so an authenticated attacker (PR:L) who holds a refresh token issued before an administrator demotion can replay it to mint a new access token that still carries the higher-privilege role, such as DomainAdmin or SysAdmin. The exposure is bounded by the token's natural expiry and only matters in environments where privileged accounts are actually demoted or revoked, since the attacker must either be the demoted user or have captured their pre-demotion token. No public exploit code has been identified at time of analysis, there is no KEV listing, and the independent assessment rates this a credible mid-to-high priority issue rather than an emergency.
Remote code execution in SmarterMail builds before 9777 allows an attacker who already holds a SysAdmin-scoped access token to escape the Volume Mount script-directory containment and execute code as the SmarterMail service account with SYSTEM-level privileges. The chain abuses administrative endpoints - domain-put to provision a mail domain with an arbitrary FileStore root inside the trusted Scripts directory, AddOrUpdateMount to disclose the Scripts path, and global-mail to clear the upload extension blacklist - then uploads a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, yielding a reverse shell. Exploitation is post-authentication and access-gated by the required high-privilege token, no public exploit has been identified at time of analysis, and the vendor has released a fix in build 9777 (Oct 8, 2026).
Authenticated attackers can read arbitrary JSON files from SmarterMail servers prior to build 9560 through a path traversal vulnerability in the /api/v1/report/summary/{type} endpoint. The vulnerability chains with weak encryption and hardcoded keys to decrypt stored passwords and two-factor authentication secrets for all system users, enabling complete account compromise. VulnCheck identified this vulnerability; vendor patch available in build 9560 or later. CVSS 8.7 reflects high confidentiality and integrity impact with low attack complexity, though requiring authenticated access (PR:L) moderates immediate risk for internet-exposed instances with strong authentication controls.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
SmarterTools SmarterMail prior to build 9511 contains a second critical vulnerability (CVE-2026-24423) — an unauthenticated remote code execution flaw in the ConnectToHub API method. An attacker can redirect the SmarterMail server to connect to a malicious HTTP endpoint that serves OS commands for execution. KEV-listed with EPSS 29%, this is chainable with CVE-2026-23760 for complete server compromise.
Full administrative takeover of SmarterTools SmarterMail (builds prior to 9511) is possible because the force-reset-password endpoint of the password reset API accepts anonymous requests and skips verification of the current password or a reset token for system administrator accounts. A remote unauthenticated attacker who knows or guesses an admin username can set an arbitrary new password and seize the system administrator role, which in SmarterMail permits OS command execution and therefore SYSTEM/root-level control of the host. This is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and the EPSS score of 65.41% (98th percentile) reflects high near-term exploitation likelihood.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any location on the mail server - including web-executable directories - without credentials and without user interaction. The flaw is rated CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), is confirmed actively exploited (CISA KEV), and has publicly available exploit code (watchTowr), making internet-facing instances an urgent priority. Code executed post-exploitation runs with the privileges of the mail service account, effectively handing the attacker the mail server.
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored mutation cross-site scripting in SmarterMail builds before 9777 allows an unauthenticated remote attacker to execute arbitrary script inside a victim's authenticated webmail session by delivering a crafted iCal calendar message whose body hides an <img src=x onerror=...> payload inside a <style> element nested in MathML foreign content (<math><mtext><mglyph>); the script fires as the recipient opens the message at /interface/message-iframe. The root cause is a sanitizer parsing differential - the custom HTML sanitizer treats the nested <style> as inert CDATA while browsers reparse it as live markup - and a permissive Content-Security-Policy does not block the resulting execution or data exfiltration. Vendor-scored CVSS 4.0 5.3 and the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N agree on a medium-severity, browser/session-confined impact; exploitation requires the victim to open the message, no public exploit code was identified at time of analysis, and there is no CISA KEV entry. Vendor-released patch: SmarterMail build 9777 (Oct 8, 2026).
SmarterMail before build 9518 allows unauthenticated attackers to exploit a path traversal flaw in the background preview endpoint by supplying base64-encoded UNC paths, forcing the Windows service to initiate SMB connections to attacker-controlled servers. This enables credential coercion and NTLM relay attacks without requiring authentication or user interaction. No patch is currently available for this vulnerability.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SmarterTools SmarterMail before Build 7776 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 16.x before build 6995 has stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token is redeemed at POST /api/v1/auth/refresh-token, so an authenticated attacker (PR:L) who holds a refresh token issued before an administrator demotion can replay it to mint a new access token that still carries the higher-privilege role, such as DomainAdmin or SysAdmin. The exposure is bounded by the token's natural expiry and only matters in environments where privileged accounts are actually demoted or revoked, since the attacker must either be the demoted user or have captured their pre-demotion token. No public exploit code has been identified at time of analysis, there is no KEV listing, and the independent assessment rates this a credible mid-to-high priority issue rather than an emergency.
Remote code execution in SmarterMail builds before 9777 allows an attacker who already holds a SysAdmin-scoped access token to escape the Volume Mount script-directory containment and execute code as the SmarterMail service account with SYSTEM-level privileges. The chain abuses administrative endpoints - domain-put to provision a mail domain with an arbitrary FileStore root inside the trusted Scripts directory, AddOrUpdateMount to disclose the Scripts path, and global-mail to clear the upload extension blacklist - then uploads a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, yielding a reverse shell. Exploitation is post-authentication and access-gated by the required high-privilege token, no public exploit has been identified at time of analysis, and the vendor has released a fix in build 9777 (Oct 8, 2026).
Authenticated attackers can read arbitrary JSON files from SmarterMail servers prior to build 9560 through a path traversal vulnerability in the /api/v1/report/summary/{type} endpoint. The vulnerability chains with weak encryption and hardcoded keys to decrypt stored passwords and two-factor authentication secrets for all system users, enabling complete account compromise. VulnCheck identified this vulnerability; vendor patch available in build 9560 or later. CVSS 8.7 reflects high confidentiality and integrity impact with low attack complexity, though requiring authenticated access (PR:L) moderates immediate risk for internet-exposed instances with strong authentication controls.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
SmarterTools SmarterMail prior to build 9511 contains a second critical vulnerability (CVE-2026-24423) — an unauthenticated remote code execution flaw in the ConnectToHub API method. An attacker can redirect the SmarterMail server to connect to a malicious HTTP endpoint that serves OS commands for execution. KEV-listed with EPSS 29%, this is chainable with CVE-2026-23760 for complete server compromise.
Full administrative takeover of SmarterTools SmarterMail (builds prior to 9511) is possible because the force-reset-password endpoint of the password reset API accepts anonymous requests and skips verification of the current password or a reset token for system administrator accounts. A remote unauthenticated attacker who knows or guesses an admin username can set an arbitrary new password and seize the system administrator role, which in SmarterMail permits OS command execution and therefore SYSTEM/root-level control of the host. This is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and the EPSS score of 65.41% (98th percentile) reflects high near-term exploitation likelihood.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any location on the mail server - including web-executable directories - without credentials and without user interaction. The flaw is rated CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), is confirmed actively exploited (CISA KEV), and has publicly available exploit code (watchTowr), making internet-facing instances an urgent priority. Code executed post-exploitation runs with the privileges of the mail service account, effectively handing the attacker the mail server.
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored mutation cross-site scripting in SmarterMail builds before 9777 allows an unauthenticated remote attacker to execute arbitrary script inside a victim's authenticated webmail session by delivering a crafted iCal calendar message whose body hides an <img src=x onerror=...> payload inside a <style> element nested in MathML foreign content (<math><mtext><mglyph>); the script fires as the recipient opens the message at /interface/message-iframe. The root cause is a sanitizer parsing differential - the custom HTML sanitizer treats the nested <style> as inert CDATA while browsers reparse it as live markup - and a permissive Content-Security-Policy does not block the resulting execution or data exfiltration. Vendor-scored CVSS 4.0 5.3 and the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N agree on a medium-severity, browser/session-confined impact; exploitation requires the victim to open the message, no public exploit code was identified at time of analysis, and there is no CISA KEV entry. Vendor-released patch: SmarterMail build 9777 (Oct 8, 2026).
SmarterMail before build 9518 allows unauthenticated attackers to exploit a path traversal flaw in the background preview endpoint by supplying base64-encoded UNC paths, forcing the Windows service to initiate SMB connections to attacker-controlled servers. This enables credential coercion and NTLM relay attacks without requiring authentication or user interaction. No patch is currently available for this vulnerability.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SmarterTools SmarterMail before Build 7776 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SmarterTools SmarterMail 16.x before build 6995 has stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.