NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

SmarterTools SmarterMail: upload flaw CVE-2025-52691 and admin password-reset bypass CVE-2026-23760 exploited

Two SmarterMail mail-server flaws, CVE-2025-52691 (file upload) and CVE-2026-23760 (admin password reset), are under attack, and CISA flags ransomware use. Fixed in Build 9511. Businesses running SmarterMail should update now and check for unexpected admin accounts.

What to do

If you run SmarterMail, update to Build 9511 or later (the current build from SmarterTools) straight away. Then check for administrator accounts you did not create or password resets you did not request. If someone else runs your email, ask them whether they have updated.

What’s happening

SmarterMail is mail-server software run by businesses and hosting providers. Two flaws in it are being used in attacks. CVE-2025-52691 (CVSS 10) lets someone with no login upload files anywhere on the server, which can lead to running their own code. It affects Build 9406 and earlier and was fixed in Build 9413. CVE-2026-23760 (CVSS 9.8) lets an anonymous attacker reset a system administrator's password through the password-reset function, taking over the whole mail server. It affects Build 9510 and earlier and was fixed in Build 9511, released on 15 January 2026. Attacks on the password-reset flaw began about two days after that fix. CISA added both flaws to its list of exploited vulnerabilities on 26 January 2026 and marked both as used in ransomware. A third flaw, CVE-2026-24423, was used by the Storm-2603 ransomware group to breach SmarterTools itself; it is separate from these two. This is mostly a business issue, since the software is rarely used at home. Fixes exist for every affected version listed. Later builds exist; no newer development on these two flaws was found.

What
Flaw
Affects
SmarterTools SmarterMail email server
Affected
SmarterMail Build 9406 and earlier (CVE-2025-52691)
SmarterMail Build 9510 and earlier (CVE-2026-23760)
Fixed in
Build 9413 (CVE-2025-52691)
Build 9511 (CVE-2026-23760; later builds also fix it)
CVE
CVE-2025-52691, CVE-2026-23760
Since
26 Jan 2026
Closed
6 Feb 2026

Timeline

  1. Wider attacks

    Help Net Security reported that the Storm-2603 ransomware group breached SmarterTools itself through a third SmarterMail flaw, CVE-2026-24423, which CISA had also listed. It is a separate flaw from the two covered here and is also fixed in Build 9511.

  2. Update

    Censys advised that builds 9510 and earlier are affected by CVE-2026-23760, that Build 9511 or later fixes it, and that the earlier upload flaw's patch does not cover it. It counted 157,429 exposed SmarterMail web properties.

  3. CISA added

    CISA added CVE-2025-52691 and CVE-2026-23760 to its Known Exploited Vulnerabilities catalogue; the listing marks both as used in ransomware.

  4. Wider attacks

    BleepingComputer reported that attackers were already using the password-reset bypass to take over administrator accounts, about two days after the patch, apparently after studying the fix. watchTowr had reported the flaw to SmarterTools on 8 January.

  5. New fixFixed

    SmarterTools released Build 9511, flagged as containing critical security fixes. It also removed two system-administrator API endpoints and limited the About/checkup page to local network addresses. This build fixes the password-reset bypass later tracked as CVE-2026-23760.

  6. Made public

    Singapore's Cyber Security Agency published an alert on CVE-2025-52691, a CVSS 10 flaw that lets an unauthenticated attacker upload files anywhere on the mail server. It affects Build 9406 and earlier and urged an immediate move to Build 9413.

  7. New fixFixed

    SmarterTools released SmarterMail Build 9413, flagged in its release notes as containing critical security fixes. Singapore's CSA later named this build as the fix for CVE-2025-52691.

Sources

  1. SmarterMail release notesSmarterTools · 15 Jan 2026
  2. Vulnerability in SmarterMail (CVE-2025-52691)Cyber Security Agency of Singapore · 29 Dec 2025
  3. January 27 Advisory: SmarterMail Authentication Bypass [CVE-2026-23760]Censys · 27 Jan 2026
  4. SmarterMail auth bypass flaw now exploited to hijack admin accountsBleepingComputer · 22 Jan 2026
  5. Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)Help Net Security · 6 Feb 2026
  6. SmarterMail Security Alert: Multiple CVEs Actively Exploited in the WildRidge Security · 1 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS