SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API (CVE-2026-23760)

What is affected, what to do

The vulnerability CVE-2026-23760 is an authentication bypass in SmarterTools SmarterMail's password reset API. An unauthenticated attacker can reset administrator accounts by providing a username and new password, leading to full control of the SmarterMail instance. This vulnerability is actively exploited in ransomware campaigns and is listed in the CISA KEV catalog. Affected are versions prior to build 9511. Immediate patching to version 100.0.9511 is critical to prevent administrative compromise.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update SmarterTools SmarterMail to version 100.0.9511. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SmarterTools SmarterMail lt *..100.0.9511

Fixed in

• SmarterTools SmarterMail 100.0.9511

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Every SmarterMail instance below build 9511 is vulnerable. Upgrade to build 9511 or later immediately. Check the SmarterTools vendor advisory for the latest build and prefer it. Verify the installer against the official vendor download before deploying.
   • Cut exposure: If you cannot upgrade within hours, block internet access to the SmarterMail web interface and API (HTTP/HTTPS) at the perimeter firewall. Alternatively, restrict access to admin source networks or VPN. SMTP, IMAP and POP3 can stay open to keep mail flowing.
   • Check for compromise before patching: Look in web server and SmarterMail logs for requests to force-reset-password from unknown source IPs. If you find any, treat the box as compromised. Isolate the host and preserve evidence (memory image, logs, SmarterMail configuration directory) rather than simply patching over it.
   • Rotate credentials: Reset passwords on all SmarterMail system administrator accounts. Also rotate every credential stored on or used by the host: service accounts, SMTP relay credentials, and domain accounts that log on to it.
   • Audit admin accounts: Reconcile the system admin list against your known-good baseline. Disable and document any unknown accounts.
   • Prepare for reporting: Exploitation yields SYSTEM/root code execution, and CISA flags use in ransomware campaigns. On confirmed compromise, prepare the NIS2 early warning to your CSIRT/BSI within 24 hours.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the SmarterMail host in a DMZ zone with no direct path to domain controllers, file servers or backup infrastructure. Restrict host egress to SMTP (25/587) and required update destinations, and deny everything else. This hampers reverse shells and payload staging.
   • WAF/reverse proxy: Front the server with a reverse proxy (IIS ARR, nginx or a WAF). Deny any request whose URI path contains force-reset-password unless it originates from the admin network. Add rate limiting on all API paths containing auth or password.
   • IPS signature: Add a local Suricata/Snort rule: alert http any any -> $SMARTERMAIL_SERVERS any (msg:"SmarterMail force-reset-password anon"; http.uri; content:"force-reset-password"; nocase; sid:9000001;). Run it in alert mode first, then switch to drop once validated.
   • Endpoint hardening: Where the vendor supports it, run the SmarterMail service under a dedicated low-privilege account instead of LocalSystem. Use EDR custom rules or AppLocker/WDAC to block child processes of the SmarterMail service (cmd.exe, powershell.exe, rundll32.exe, certutil.exe).
   • IAM: Minimise the number of system admin accounts and avoid predictable usernames such as admin. Enable multi-factor authentication for admin accounts where available.
   • Backup protection: Verify offline or immutable backups of the mail store and configuration, given the confirmed ransomware use.
3. 03

   Runbook step 3

   Detection rules

   • Web server logs (IIS W3C / SmarterMail logs): POST requests to URIs containing force-reset-password from external IPs, especially without a prior successful login from the same source. SPL: index=web uri_path="*force-reset-password*" | stats count by src_ip, uri_path, status
   • Admin login anomaly: A successful system admin login shortly after a password reset, from a new source IP or ASN. Correlate these events in the SmarterMail administrative logs.
   • EDR/Sysmon process ancestry (Sysmon EID 1, Security EID 4688): The SmarterMail service process (typically MailService.exe) spawning cmd.exe, powershell.exe, whoami.exe or net.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "MailService.exe" and FileName in~ ("cmd.exe","powershell.exe","whoami.exe","net.exe")
   • Persistence: New services (System EID 7045), scheduled tasks (Security EID 4698) or new local accounts (EID 4720) on the mail host shortly after a reset event.
   • Network telemetry (Zeek/Suricata): Outbound connections from the mail host to unfamiliar destinations on non-mail ports. Unusual outbound data volumes suggest pre-encryption exfiltration.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Source: CISA KEV Catalog, NVD (NIST), CVE.org (MITRE), pwn.watch, cvelistv5

Vendors and products

• SmarterTools SmarterTools SmarterMail

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• smartertools.comSmarterTools SmarterMail — CVE-2025-52691Release notes, Patch, pwn-watch
• labs.watchtowr.comattackers-with-decompilers-strike-again-smartertools-smartermai…Technical description, Exploit
• code-white.compublic-vulnerability-listThird-party advisory
• vulncheck.comadvisories/smartertools-smartermail-authentication-bypass-via-p…Third-party advisory
• huntress.comblog/smartermail-account-takeover-leading-to-rceThird-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760government-resource
• pwn.watchpwn.watch: SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-52691pwn-watch
• NVD (NIST)NVD: CVE-2026-23760pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch