Authentication Bypass in SmarterMail Product by SmarterTools
CVE-2026-23760

9.3CRITICAL

Key Information:

Vendor

Smartertools

Status
Smartermail
Vendor
CVE Published:
22 January 2026

Badges

📈 Score: 313👾 Exploit Exists🟡 Public PoC🟣 EPSS 52%🦅 CISA Reported

What is CVE-2026-23760?

CVE-2026-23760 is a critical security vulnerability found in SmarterMail, a mail server application designed for managing email communication within organizations. The vulnerability lies in the password reset API, specifically the force-reset-password endpoint, which is improperly secured. This flaw allows unauthenticated attackers to reset the passwords of system administrator accounts without needing any valid credentials or reset tokens. Consequently, an attacker could fully compromise the SmarterMail instance, gaining complete administrative control. With administrative privileges, they have the power to execute operating system commands, potentially leading to serious breaches and exploitation of the underlying system.

Potential impact of CVE-2026-23760

  1. Complete Administrative Compromise: The vulnerability allows unauthorized users to reset administrator passwords, effectively granting them full control over the SmarterMail instance. This could lead to further exploits and manipulations of the mail server.

  2. Execution of Arbitrary Commands: With administrative access, attackers can leverage built-in management functions to execute commands on the operating system. This could lead to data exfiltration, system modifications, or the installation of malicious software.

  3. Data Breach and Organizational Risk: The control gained from this vulnerability not only threatens the integrity of email communications but could also result in significant data breaches. Sensitive information accessible through SmarterMail could be leaked or misused, impacting the organization’s reputation and leading to legal ramifications.

CISA has reported CVE-2026-23760

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-23760 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SmarterMail 0 < 100.0.9511

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-23760 - Proof of Concept

smartermail-CVE-2026-23760-poc
Created by MaxMnMl

References

https://www.smartertools.com/smartermail/release-notes/cu...
release-notespatch
https://labs.watchtowr.com/attackers-with-decompilers-str...
technical-descriptionexploit
https://code-white.com/public-vulnerability-list/#authent...
third-party-advisory

EPSS Score

52% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🦅

    CISA Reported

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Piotr Bazydlo & Sina Kheirkhah of watchTowr
JSON
.