CVE-2026-23760

SmarterTools SmarterMail: Authentication Bypass Using an Alternate Path or Channel

As of , CVE-2026-23760 in SmarterTools SmarterMail is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.

Exploited
Yes: CISA listed it on 26 January 2026
US federal deadline
16 February 202621 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 26 February 2026.
EPSS score
0.97Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: www.smartertools.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

CISA's description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

The CVE record's description, from VulnCheck

CVE published
22 January 2026
Assigned by
VulnCheck
CVSS
9.3 Critical (CVSS 4.0, from the CNA)
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Ransomware use: Unknown to Known.

SmarterMail: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-52691Unrestricted Upload of File with Dangerous TypeSmarterTools SmarterMailPatch nowRansomware use, listed within a year; Metasploit module0.86
CVE-2026-24423Missing Authentication for Critical FunctionSmarterTools SmarterMailPatch nowRansomware use, listed within a year0.88

Read further