CVE-2026-23760
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability - [Actively Exploited]
Description
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
INFO
Published Date :
Jan. 22, 2026, 3:16 p.m.
Last Modified :
Jan. 27, 2026, 4:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://www.smartertools.com/smartermail/release-notes/current ; https://nvd.nist.gov/vuln/detail/CVE-2026-23760
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | CRITICAL | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update SmarterMail to build 9511 or later.
- Review password reset API security settings.
- Enforce strong password policies.
Public PoC/Exploit Available at Github
CVE-2026-23760 has a 4 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23760.
| URL | Resource |
|---|---|
| https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail | Third Party Advisory |
| https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/ | Exploit Third Party Advisory |
| https://www.smartertools.com/smartermail/release-notes/current | Release Notes |
| https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760 | US Government Resource |
| https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce | Exploit Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23760 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23760
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
A Remote Code Execution vulnerability allowing unauthenticated attackers to upload arbitrary PHP files directly to the web server. This results in immediate Remote Code Execution with web server privileges.
Mirror of https://github.com/nomi-sec/PoC-in-GitHub
CVE-2026-23760 - An authentication bypass via password reset API in SmarterMail.
SmarterMail Auth Bypass & RCE Exploit
smartermail-auth-bypass smartermail-rce smartermail-vulnerable cve-2026-23760
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23760 vulnerability anywhere in the article.
-
The Hacker News
Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server
SmarterTools confirmed last week that the Warlock (aka Storm-2603) ransomware gang breached its network by exploiting an unpatched SmarterMail instance. The incident took place on January 29, 2026, wh ... Read more
-
The Cyber Express
SmarterTools Breached by Own SmarterMail Vulnerabilities
SmarterTools was breached by hackers exploiting a vulnerability in its own SmarterMail software through an unknown virtual machine set up by an employee that wasn’t being updated. “Prior to the breach ... Read more
-
The Register
Telcos aren't saying how they fought back against China's Salt Typhoon attacks
Infosec In Brief So-hot-right-now AI assistant OpenClaw, which is very much not secure right now, has teamed up with security scanning service VirusTotal. The tie-up means “skills” in the ClawHub – cu ... Read more
-
Help Net Security
Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)
For the third time in two weeks, CISA added a vulnerability (CVE-2026-24423) affecting SmarterTools’ SmarterMail email and collaboration server to its Known Exploited Vulnerabilities catalog, and this ... Read more
-
security.nl
SmarterMail-servers aangevallen via kritieke RCE-kwetsbaarheid
Aanvallers maken actief misbruik van een kritieke kwetsbaarheid in SmarterMail waardoor kwetsbare servers op afstand zijn over te nemen, zo waarschuwt het Amerikaanse cyberagentschap CISA. Drie weken ... Read more
-
The Hacker News
SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score
SmarterTools has addressed two more security flaws in SmarterMail email software, including one critical security flaw that could result in arbitrary code execution. The vulnerability, tracked as CVE- ... Read more
-
BleepingComputer
Over 6,000 SmarterMail servers exposed to automated hijacking attacks
Nonprofit security organization Shadowserver has found over 6,000 SmarterMail servers exposed online and likely vulnerable to attacks exploiting a critical authentication bypass vulnerability. Cyberse ... Read more
-
CybersecurityNews
6000+ Vulnerable SmarterTools SmarterMail Servers Exposed to Actively Exploited RCE Vulnerability
Over 6,000 SmarterMail servers exposed on the internet are running vulnerable versions that are at risk of active remote code execution (RCE) attacks. Security researchers identified the flaws through ... Read more
-
security.nl
'6.000 SmarterMail-servers bevatten actief misbruikte reset-kwetsbaarheid'
Zo'n zesduizend SmarterMail-servers bevatten zeer waarschijnlijk een kritieke kwetsbaarheid waardoor ongeauthenticeerde aanvallers het wachtwoord van de administrator kunnen resetten, zo laat The Shad ... Read more
-
TheCyberThrone
CISA KEV Catalog Update – 5 Vulnerabilities Added
January 27, 20261) CVE-2018-14634 – Linux Kernel Integer Overflow (Local Privilege Escalation)Type: Integer overflow in the Linux kernel’s create_elf_tables() function.Impact: A local, unprivileged us ... Read more
-
Huntress
Huntress Catches SmarterMail Account Takeover Leading to RCE
Background / Summary The Huntress DE&TH (Detection Engineering and Threat Hunting) Team has observed in-the-wild exploitation of a privileged account takeover vulnerability (CVE-2026-23760) in Smarter ... Read more
The following table lists the changes that have been made to the
CVE-2026-23760 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* versions up to (excluding) 100.0.9511 Added Reference Type VulnCheck: https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail Types: Third Party Advisory Added Reference Type VulnCheck: https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/ Types: Exploit, Third Party Advisory Added Reference Type VulnCheck: https://www.smartertools.com/smartermail/release-notes/current Types: Release Notes Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api Types: Third Party Advisory Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760 Types: US Government Resource Added Reference Type CISA-ADP: https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jan. 26, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760 Added Reference https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce -
CVE Modified by [email protected]
Jan. 23, 2026
Action Type Old Value New Value Changed Description SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host. -
CVE Modified by [email protected]
Jan. 23, 2026
Action Type Old Value New Value Added Reference https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail -
New CVE Received by [email protected]
Jan. 22, 2026
Action Type Old Value New Value Added Description SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-288 Added Reference https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/ Added Reference https://www.smartertools.com/smartermail/release-notes/current Added Reference https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api