SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-52691 | Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr. Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines. | 10.0 | 86% | KEV ransomware PoC |
| moderateseveral thousand internet-exposed SmarterMail servers (niche Windows mail server with a total install base in the low tens of thousands) | |
| CVE-2026-23760 | Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress. Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments. | 9.3 | 96% | KEV ransomware PoC ×2 |
| moderate≈6,000+ internet-exposed SmarterMail servers |
Full article1,017 words · extracted from thehackernews.com · click to collapse
A new security flaw in SmarterTools SmarterMail email software has come under active exploitation in the wild, two days after the release of a patch.
The vulnerability, which currently does not have a CVE identifier, is tracked by watchTowr Labs as WT-2026-0001. It was patched by SmarterTools on January 15, 2026, with Build 9511, following responsible disclosure by the exposure management platform on January 8, 2026. Markus Wulftange of CODE WHITE GmbH, the finder has also been credited with reporting the same flaw.
It has been described as an authentication bypass flaw that could allow any user to reset the SmarterMail system administrator password by means of a specially crafted HTTP request to the "/api/v1/auth/force-reset-password" endpoint.
"The kicker of course being that said user is able to use RCE-as-a-feature functions to directly execute OS [operating system] commands," watchTowr Labs researchers Piotr Bazydlo and Sina Kheirkhah said.
The problem is rooted in the function "SmarterMail.Web.Api.AuthenticationController.ForceResetPassword," which not only allows the endpoint to be reached without authentication, but also leverages the fact that the reset request is accompanied by a boolean flag named "IsSysAdmin" to handle the incoming request depending on whether the user is a system administrator or not.
In case the flag is set to "true" (i.e., indicating that the user is an administrator), the underlying logic performs the following sequence of actions -
- Obtain the configuration corresponding to the username passed as input in the HTTP request
- Create a new system administrator item with the new password
- Update the administrator account with the new password
In other words, the privileged path is configured such that it can trivially update an administrator user's password by sending an HTTP request with the username of an administrator account and a password of their choice. This complete lack of security control could be abused by an attacker to obtain elevated access, provided they have knowledge of an existing administrator username.
It doesn't end there, for the authentication bypass provides a direct path to remote code execution through a built-in functionality that allows a system administrator to execute operating system commands on the underlying operating system and obtain a SYSTEM-level shell.
This can be accomplished by navigating to the Settings page, creating a new volume, and supplying an arbitrary command in the Volume Mount Command field that gets subsequently executed by the host's operating system.
The cybersecurity company said it chose to make the finding public following a post on the SmarterTools Community Portal, where a user claimed that they lost access to their admin account, with the logs indicating the use of the same "force-reset-password" endpoint to change the password on January 17, 2026, two days after the release of the patch.
This likely indicates that the attackers managed to reverse engineer the patches and reconstruct the flaw. To make matters worse, it doesn't help that SmarterMail's release notes are vague and do not explicitly mention what issues were addressed. One item in the bulleted list for Build 9511 simply mentions "IMPORTANT: Critical security fixes."
In response, SmarterTools CEO Tim Uzzanti hinted that this is done so to avoid giving threat actors more ammunition, but noted they plan to send an email every time a new CVE is discovered and again when a build has been released to resolve the issue.
"In our 23+ years, we have had only a few CVEs, which were primarily communicated through release notes and critical fix references," Uzzanti said in response to transparency concerns raised by its customers. "We appreciate the feedback that encouraged this change in policy moving forward."
When reached for comment, SmarterTools told The Hacker News that it released a fix for the vulnerability on January 15, 2026, adding it sent out notifications to all customers, asking them to update to the latest version.
"At the time of that release, we did notify all SmarterMail customers that a new version was released that fixed a critical security issue, and we strongly urged them to upgrade," Derek Curtis, chief operating officer at SmarterTools, said. "As we don't manage installations ourselves – our SmarterMail software is on-premises – we have to rely on customers to read our notifications, then upgrade as soon as they feel it's prudent to do so."
The development comes less than a month after the Cyber Security Agency of Singapore (CSA) disclosed details of a maximum-severity security flaw in SmarterMail (CVE-2025-52691, CVSS score: 10.0) that could be exploited to achieve remote code execution.
Update
The vulnerability has been assigned the CVE identifier CVE-2026-23760 (CVSS score: 9.3), with Huntress noting that it has observed in-the-wild exploitation of the privileged account takeover vulnerability that could result in remote code execution.
The cybersecurity company also said CVE-2025-52691 has come under mass exploitation, making it essential that users of SmarterMail update to the latest version as soon as possible.
Jai Minton, senior manager of detection engineering and threat hunting at Huntress, told The Hacker News that CVE-2025-52691 is being exploited to deliver low sophistication web shells and "suspected loaders of malware written to Startup directories in order to achieve persistence and execution when the system is restarted."
Minton also stated that all the IP addresses attempting to exploit CVE-2026-23760 are tied to virtual infrastructure in the U.S., and that the exact origin of the attacks is unknown. As for attribution, there is no evidence to suggest either vulnerabilities being exploited are tied to any particular threat actor.
"Given the severity of this vulnerability, active exploitation, and exploitation of the additional CVE-2025-52691 being observed in the wild, businesses should prioritize the deployment of SmarterMail updates and review any outdated systems for signs of infection," it added.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added both the SmarterMail flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by February 16, 2026.
(The story was updated after publication on January 27, 2026, to reflect the latest developments.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/smartermail-auth-bypass-exploited-in.html