SmarterTools patches critical SmarterMail flaw allowing code execution

SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress.

Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments.

SmarterTools SmarterMail builds prior to build 9511 fail to require authentication on the ConnectToHub API method (CWE-306, Missing Authentication for Critical Function), resulting in unauthenticated remote code execution. An attacker triggers the flaw by directing SmarterMail to connect to an attacker-controlled HTTP server, which serves a malicious OS command that the vulnerable application then executes on the host. Successful exploitation yields arbitrary command execution on the mail server, enough for full system compromise and serving as the initial-access vector for the Warlock ransomware group. Any organization running an affected SmarterMail build is exposed, particularly those with the server's web/API interface reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05 with known ransomware use, and EPSS assigns an 87.7% probability of exploitation within 30 days (100th percentile).

Do: Upgrade SmarterMail to build 9511 or later as soon as possible, prioritizing internet-facing mail servers. If patching cannot be done immediately, restrict internet access to the SmarterMail web/API interface and monitor the host for signs of compromise given confirmed ransomware exploitation. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing.