{"id":"smartermail-upload-auth-bypass-exploited-jan-2026","category":"patch","status":"closed","title":"SmarterTools SmarterMail: upload flaw CVE-2025-52691 and admin password-reset bypass CVE-2026-23760 exploited","tldr":"Two SmarterMail mail-server flaws, CVE-2025-52691 (file upload) and CVE-2026-23760 (admin password reset), are under attack, and CISA flags ransomware use. Fixed in Build 9511. Businesses running SmarterMail should update now and check for unexpected admin accounts.","summary":"SmarterMail is mail-server software run by businesses and hosting providers. Two flaws in it are being used in attacks. CVE-2025-52691 (CVSS 10) lets someone with no login upload files anywhere on the server, which can lead to running their own code. It affects Build 9406 and earlier and was fixed in Build 9413. CVE-2026-23760 (CVSS 9.8) lets an anonymous attacker reset a system administrator's password through the password-reset function, taking over the whole mail server. It affects Build 9510 and earlier and was fixed in Build 9511, released on 15 January 2026. Attacks on the password-reset flaw began about two days after that fix. CISA added both flaws to its list of exploited vulnerabilities on 26 January 2026 and marked both as used in ransomware. A third flaw, CVE-2026-24423, was used by the Storm-2603 ransomware group to breach SmarterTools itself; it is separate from these two. This is mostly a business issue, since the software is rarely used at home. Fixes exist for every affected version listed. Later builds exist; no newer development on these two flaws was found.","action":"If you run SmarterMail, update to Build 9511 or later (the current build from SmarterTools) straight away. Then check for administrator accounts you did not create or password resets you did not request. If someone else runs your email, ask them whether they have updated.","product":"SmarterTools SmarterMail email server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-52691","CVE-2026-23760"],"tags":["smartermail","smartertools","email-server","authentication-bypass","file-upload","ransomware","cisa-kev","remote-code-execution"],"affected":["SmarterMail Build 9406 and earlier (CVE-2025-52691)","SmarterMail Build 9510 and earlier (CVE-2026-23760)"],"fixed":["Build 9413 (CVE-2025-52691)","Build 9511 (CVE-2026-23760; later builds also fix it)"],"matches":[],"sources":[{"kind":"advisory","title":"SmarterMail release notes","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","date":"2026-01-15"},{"kind":"advisory","title":"Vulnerability in SmarterMail (CVE-2025-52691)","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/","by":"Cyber Security Agency of Singapore","date":"2025-12-29"},{"kind":"research","title":"January 27 Advisory: SmarterMail Authentication Bypass [CVE-2026-23760]","url":"https://censys.com/advisory/cve-2026-23760/","by":"Censys","date":"2026-01-27"},{"kind":"news","title":"SmarterMail auth bypass flaw now exploited to hijack admin accounts","url":"https://www.bleepingcomputer.com/news/security/smartermail-auth-bypass-flaw-now-exploited-to-hijack-admin-accounts/","by":"BleepingComputer","date":"2026-01-22"},{"kind":"news","title":"Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","date":"2026-02-06"},{"kind":"research","title":"SmarterMail Security Alert: Multiple CVEs Actively Exploited in the Wild","url":"https://ridgesecurity.ai/blog/smartermail-security-alert-multiple-cves-actively-exploited-in-the-wild/","by":"Ridge Security","date":"2026-02-01"}],"started":"2026-01-26","closed":"2026-02-06","created":"2026-11-03T22:04:03.628Z","updated":"2026-11-03T22:04:03.628Z","cve_notes":[{"cve":"CVE-2025-52691","name":"Unauthenticated file upload to any location in SmarterMail","what":"An upload flaw in SmarterMail's upload function that lets an attacker with no login write files anywhere on the mail server, which can lead to running their own code.","severity":"critical","cvss":10},{"cve":"CVE-2026-23760","name":"Admin password-reset bypass in SmarterMail","what":"A flaw in SmarterMail's password-reset function that accepts anonymous requests and does not check the old password or a reset token, so an attacker can reset a system administrator's password and take over the server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-02-06","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Help Net Security reported that the Storm-2603 ransomware group breached SmarterTools itself through a third SmarterMail flaw, CVE-2026-24423, which CISA had also listed. It is a separate flaw from the two covered here and is also fixed in Build 9511.","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","patch":null},{"at":"2026-01-27","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Censys advised that builds 9510 and earlier are affected by CVE-2026-23760, that Build 9511 or later fixes it, and that the earlier upload flaw's patch does not cover it. It counted 157,429 exposed SmarterMail web properties.","url":"https://censys.com/advisory/cve-2026-23760/","by":"Censys","patch":null},{"at":"2026-01-26","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2025-52691 and CVE-2026-23760 to its Known Exploited Vulnerabilities catalogue; the listing marks both as used in ransomware.","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"BleepingComputer reported that attackers were already using the password-reset bypass to take over administrator accounts, about two days after the patch, apparently after studying the fix. watchTowr had reported the flaw to SmarterTools on 8 January.","url":"https://www.bleepingcomputer.com/news/security/smartermail-auth-bypass-flaw-now-exploited-to-hijack-admin-accounts/","by":"BleepingComputer","patch":null},{"at":"2026-01-15","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"SmarterTools released Build 9511, flagged as containing critical security fixes. It also removed two system-administrator API endpoints and limited the About/checkup page to local network addresses. This build fixes the password-reset bypass later tracked as CVE-2026-23760.","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","patch":"patched"},{"at":"2025-12-29","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Singapore's Cyber Security Agency published an alert on CVE-2025-52691, a CVSS 10 flaw that lets an unauthenticated attacker upload files anywhere on the mail server. It affects Build 9406 and earlier and urged an immediate move to Build 9413.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2025-10-09","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"SmarterTools released SmarterMail Build 9413, flagged in its release notes as containing critical security fixes. Singapore's CSA later named this build as the fix for CVE-2025-52691.","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","patch":"patched"}],"url":"https://hard.fyi/live/smartermail-upload-auth-bypass-exploited-jan-2026/","json":"https://hard.fyi/api/live?id=smartermail-upload-auth-bypass-exploited-jan-2026"}