CVE-2025-52691

SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr.

What to do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines.