Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-52691 | Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr. Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines. | 10.0 | 86% | KEV ransomware PoC |
| moderateseveral thousand internet-exposed SmarterMail servers (niche Windows mail server with a total install base in the low tens of thousands) | |
| CVE-2026-23760 | Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress. Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments. | 9.3 | 96% | KEV ransomware PoC ×2 |
| moderate≈6,000+ internet-exposed SmarterMail servers | |
| CVE-2026-24423 | Unauthenticated RCE in SmarterTools SmarterMail (CVE-2026-24423) SmarterTools SmarterMail builds prior to build 9511 fail to require authentication on the ConnectToHub API method (CWE-306, Missing Authentication for Critical Function), resulting in unauthenticated remote code execution. An attacker triggers the flaw by directing SmarterMail to connect to an attacker-controlled HTTP server, which serves a malicious OS command that the vulnerable application then executes on the host. Successful exploitation yields arbitrary command execution on the mail server, enough for full system compromise and serving as the initial-access vector for the Warlock ransomware group. Any organization running an affected SmarterMail build is exposed, particularly those with the server's web/API interface reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05 with known ransomware use, and EPSS assigns an 87.7% probability of exploitation within 30 days (100th percentile). Do: Upgrade SmarterMail to build 9511 or later as soon as possible, prioritizing internet-facing mail servers. If patching cannot be done immediately, restrict internet access to the SmarterMail web/API interface and monitor the host for signs of compromise given confirmed ransomware exploitation. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing. | 9.3 | 88% | KEV ransomware |
| largeon the order of tens of thousands of deployed SmarterMail servers (10k-100k installations) |
Full article1,153 words · extracted from thehackernews.com · click to collapse
SmarterTools confirmed last week that the Warlock (aka Storm-2603) ransomware gang breached its network by exploiting an unpatched SmarterMail instance.
The incident took place on January 29, 2026, when a mail server that was not updated to the latest version was compromised, the company's Chief Commercial Officer, Derek Curtis, said.
"Prior to the breach, we had approximately 30 servers/VMs with SmarterMail installed throughout our network," Curtis explained. "Unfortunately, we were unaware of one VM, set up by an employee, that was not being updated. As a result, that mail server was compromised, which led to the breach."
However, SmarterTools emphasized that the breach did not affect its website, shopping cart, My Account portal, and several other services, and that no business applications or account data were affected or compromised.
About 12 Windows servers on the company's office network, as well as a secondary data center used for quality control (QC) tests, are confirmed to be affected. According to its CEO, Tim Uzzanti, the "attempted ransomware attack" also impacted hosted customers using SmarterTrack.
"Hosted customers using SmarterTrack were the most affected," Uzzanti said in a different Community Portal threat. "This was not due to any issue within SmarterTrack itself, but rather because that environment was more easily accessible than others once they breached our network."
Furthermore, SmarterTools acknowledged that the Warlock group waited for a couple of days after gaining initial access to take control of the Active Directory server and create new users, followed by dropping additional payloads like Velociraptor and the locker to encrypt files.
"Once these bad actors gain access, they typically install files and wait approximately 6–7 days before taking further action," Curtis said. "This explains why some customers experienced a compromise even after updating -- the initial breach occurred prior to the update, but malicious activity was triggered later."
It's currently not clear which SmarterMail vulnerability was weaponized by attackers, but it's worth noting that multiple flaws in the email software – CVE-2025-52691 (CVSS score: 10.0), CVE-2026-23760, and CVE-2026-24423 (CVSS scores: 9.3) – have come under active exploitation in the wild.
CVE-2026-23760 is an authentication bypass flaw that could allow any user to reset the SmarterMail system administrator password by sending a specially crafted HTTP request. CVE-2026-24423, on the other hand, exploits a weakness in the ConnectToHub API method to achieve unauthenticated remote code execution (RCE).
The vulnerabilities were addressed by SmarterTools in build 9511. Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that CVE-2026-24423 was being exploited in ransomware attacks.
In a report published Monday, cybersecurity company ReliaQuest said it identified activity likely linked to Warlock that involved the abuse of CVE-2026-23760 to bypass authentication and stage the ransomware payload on internet-facing systems. The attack also leverages the initial access to download a malicious MSI installer ("v4.msi") from Supabase, a legitimate cloud-based backend platform, to install Velociraptor.
"While this vulnerability allows attackers to bypass authentication and reset administrator passwords, Storm-2603 chains this access with the software's built-in 'Volume Mount' feature to gain full system control," security researcher Alexa Feminella said. "Upon entry, the group installs Velociraptor, a legitimate digital forensics tool it has used in previous campaigns, to maintain access and set the stage for ransomware."
The security outfit also noted that the two vulnerabilities have the same net result: while CVE-2026-23760 grants unauthenticated administrative access via the password reset API, which can then be combined with the mounting logic to attain code execution, CVE-2026-24423 offers a more direct path to code execution through an API path.
The fact that the attackers are pursuing the former method is an indication that it likely allows the malicious activity to blend in with typical administrative workflows, helping them avoid detection.
"By abusing legitimate features (password resets and drive mounting) instead of relying solely on a single 'noisy' exploit primitive, operators may reduce the effectiveness of detections tuned specifically for known RCE patterns," Feminella added. "This pace of weaponization is consistent with ransomware operators rapidly analyzing vendor fixes and developing working tradecraft shortly after release."
When reached for comment about the Warlock ransomware activity targeting SmarterTools, ReliaQuest told The Hacker News that it observed the attackers exploiting CVE-2026-23760 on unpatched systems running versions prior to Build 9511 shortly after the patch was released.
"We confirmed this specific vulnerability was used because we observed successful password reset requests containing specific input designed to take over the built-in system administrator account," the company said in an emailed statement. "We also saw API calls consistent with probing for the second vulnerability, CVE-2026-24423, during the same window. However, the successful password reset activity confirms that CVE-2026-23760 was the method used to gain initial access."
Users of SmarterMail are advised to upgrade to the latest version (Build 9526) with immediate effect for optimal protection, and isolate mail servers to block lateral movement attempts used to deploy ransomware.
Observed Activity Exploiting CVE-2026-24423
In a statement shared via email, watchTowr's Head of Threat Intelligence, Ryan Dewhurst, told The Hacker News that mass exploitation of CVE-2026-24423 began on January 28, 2026, and that it has observed more than 1,000 exploitation attempts originating from about 60 unique attacker IP addresses. The cybersecurity company said it also identified multiple hubAddress URLs used for out-of-band callbacks.
"This is the vulnerable (POST) parameter that allows the threat actor to call an external address. The attacker's external address then responds with arbitrary commands to execute," Dewhurst said. "A consistent marker in these requests is the nodeName field, often set to victim-$unix_epoch. It appears to be a simple yet effective way for attackers to label victims and link callbacks—nothing fancy, but it works."
Furthermore, watchTowr pointed out that the exploitation has remained consistently steady since it was first observed, with weekends being one major exception.
"Activity drops sharply and then quickly picks up again at the start of the workweek," Dewhurst said. "It appears mostly driven by operators during business hours. Either way, exploitation is ongoing, repeatable, and remains predictable. If you're not already patched, you should probably assume you've been compromised. Even the vendor itself was caught off guard with an out-of-date server getting hit. If the people shipping the fix can miss it, nobody gets a free pass."
SmarterTools Confirms the Warlock Attack Involved CVE-2026-24423
When reached for comment, Curtis told The Hacker News over email that the threat actors exploited CVE-2026-24423 to gain access to the SmarterMail instance.
"The issue involved an older SmarterMail server on one of our networks that we were unaware of, and it had not been updated by our IT department," Curtis added. "The specific vulnerability was CVE-2026-24423. As mentioned in our community post, our network architecture now looks very different than it did before."
(The story was updated after publication to include a response from watchTowr and SmarterTools.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/warlock-ransomware-breaches.html