Cryptographic Weakness in SmarterMail by SmarterTools

CVE-2026-40514

What is CVE-2026-40514?

SmarterMail versions earlier than 9610 exhibit a significant cryptographic vulnerability within their file and email sharing endpoints. The issue stems from the use of DES-CBC encryption, which relies on keys and initialization vectors generated from a poorly seeded System.Random. This insufficient entropy dramatically narrows the seed space to around 19,000 values. An unauthenticated attacker can exploit this flaw through the attachment download endpoint, effectively using it as an oracle to determine the active seed. This enables the attacker to derive encryption keys and initialization vectors, potentially forging sharing tokens that grant unauthorized access to emails, attachments, or file content without needing prior access.

References