Upload Arbitrary Files (CVE-2025-52691)

What is affected, what to do

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update smartermail to version 100.0.9413. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SmarterTools SmarterMail eq SmarterMail versions Build 9406 and earlier..SmarterMail versions Build 9406 and earlier

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every SmarterMail instance and confirm the build via the web UI About page or the file version of MailService.exe. Per the context, build 100.0.9413 is affected. Treat any instance on that build or older as potentially compromised until proven otherwise.
   • Patch: Upgrade to the current SmarterMail build. A patch is available from the vendor; look up the fixed build number in the SmarterTools advisory or release notes. Snapshot or image the server before upgrading so forensic evidence is preserved.
   • Reduce exposure: If you cannot patch immediately, restrict the webmail and admin interface at the perimeter to VPN or corporate IP ranges. This typically means TCP 80/443 or whatever custom web port is configured. SMTP/IMAP/POP3 (25/587/465, 143/993, 110/995) can stay open, because the flaw sits in the web upload path.
   • Hunt for compromise: Sweep the install and web directories (e.g. C:\Program Files (x86)\SmarterTools\SmarterMail\) for files created or modified since build 9413 was deployed. Focus on .aspx, .ashx, .asmx, .config, .dll, .exe, .ps1 and .bat. Preserve anything you find rather than deleting it.
   • Rotate credentials: If compromise is suspected, rotate:
     • SmarterMail system-admin and domain-admin accounts
     • the SmarterMail service account
     • any AD/LDAP bind or SMTP relay credentials stored on the host
   • Check reporting duties: Assess NIS2/BSIG reporting thresholds early (24 h early warning). Also assess GDPR Art. 33, since mailbox contents are personal data and this flaw is known to be used in ransomware campaigns.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the mail server in a DMZ with no direct paths to internal networks. Allow egress only for SMTP (TCP 25) to defined smarthosts and for DNS. Block outbound HTTP/HTTPS, SMB (445) and RDP (3389) from the host to stop tool staging and lateral movement.
   • WAF/reverse proxy: Publish the web UI only through a reverse proxy with a WAF. Block:
     • multipart uploads whose filename= contains traversal sequences (../, ..\, %2e%2e, %5c) or absolute paths (C:\)
     • dangerous extensions (.aspx|.ashx|.asmx|.config|.dll|.exe|.cshtml)
     • upload requests lacking a valid authenticated session cookie
   • Endpoint hardening:
     • Use AppLocker/WDAC to deny execution of binaries and scripts from SmarterMail data and web directories.
     • Use an ASR rule or EDR policy to block the SmarterMail process from spawning cmd.exe, powershell.exe or rundll32.exe.
   • Least privilege: Run the service under a dedicated account rather than LocalSystem. Grant NTFS write access only to data and log directories, not to program or web-root directories.
   • Integrity monitoring: Enable file integrity monitoring (FIM) on the SmarterMail program directory and alert on any change outside planned maintenance windows.
   • Backups: Keep offline or immutable backups of mailbox data and test restores, given the confirmed ransomware use.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 11 (FileCreate):
     • Trigger: the SmarterMail process (MailService.exe, or w3wp.exe when hosted on IIS) writes executable or web-script files outside mailbox data paths.
     • KQL: DeviceFileEvents | where InitiatingProcessFileName in~ ("MailService.exe","w3wp.exe") | where FileName matches regex @"\.(aspx|ashx|asmx|dll|exe|ps1|bat|config)$"
   • Process ancestry (Sysmon EID 1 / EDR):
     • Trigger: MailService.exe or w3wp.exe spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe or whoami.exe.
     • Sigma shape: ParentImage|endswith: '\MailService.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe']
   • Web access logs: Look for:
     • POSTs to upload functions from source IPs with no prior successful login
     • subsequent GETs to previously unseen .aspx/.ashx paths, the classic webshell pattern
     • URL-encoded traversal sequences in the body or query string
   • Network telemetry (Zeek/Suricata): New outbound connections from the mail server to external IPs over HTTP/HTTPS or unusual ports. Large outbound transfers suggest mailbox exfiltration.
   • Windows events:
     • Event ID 4720/4732: new local accounts or group memberships on the mail server.
     • Event ID 7045: new services.
     • Event ID 4698: scheduled tasks created shortly after suspicious uploads.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), pwn.watch

Vendors and products

• SmarterTools SmarterTools SmarterMail

References & sources

• csa.gov.sgalerts-and-advisories/alerts/al-2025-124
• github.comwatchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.…Exploit
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691government-resource
• pwn.watchpwn.watch: SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerabilitypwn-watch
• smartertools.comSmarterTools SmarterMail — CVE-2025-52691pwn-watch
• NVD (NIST)NVD: CVE-2025-52691pwn-watch
• NVD (NIST)NVD: CVE-2026-23760pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Translated07.10.2026nvd@nist.gov

   • Translation: after Title: SmarterMail de SmarterTools, Description: La explotación exitosa de la vulnerabilidad podría permitir a un atacante no autenticado subir archivos arbitrarios a cualquier ubicación en el servidor de correo, potencialmente habilitando la ejecución remota de código.