CVE-2026-23760
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
Description
CVE-2026-23760 is a critical authentication bypass vulnerability in SmarterTools SmarterMail affecting versions prior to build 9511. The flaw exists in the password reset API, specifically the force-reset-password endpoint, which permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. With a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated attacker can remotely reset any administrator password to take over the mail server. The vulnerability is listed in CISA's KEV catalog with a remediation deadline of February 16, 2026, and critically, CISA confirms it is associated with known ransomware campaigns. The EPSS score of 0.59794 (98.2nd percentile) reflects extremely high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| smartertools | smartermail | < 100.0.9511 |
References
- https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail(Third Party Advisory)
- https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/(Exploit, Third Party Advisory)
- https://www.smartertools.com/smartermail/release-notes/current(Release Notes)
- https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760(US Government Resource)
- https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce(Exploit, Third Party Advisory)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2026-23760 is classified under CWE-288, which describes a vulnerability where the software provides an alternate path or channel for authentication that does not require the same level of security as the primary mechanism. In this case, the SmarterMail force-reset-password API endpoint provides a direct channel to reset administrator passwords without requiring any authentication, existing password verification, or password reset token validation. This effectively creates a backdoor that bypasses all intended authentication controls, allowing an anonymous attacker to take over system administrator accounts. Learn more about CWE-288
Impact Analysis
Complete Server Takeover is the direct result of exploiting CVE-2026-23760. By resetting the system administrator password, an attacker gains full administrative control over the SmarterMail server, including access to all email accounts, server configuration, and the ability to execute code through the administration interface.
Confidentiality Impact is maximum (C:H). Administrative access to a mail server exposes the entire email corpus for all hosted accounts. This includes business communications, personal messages, attachments, contact lists, calendar data, and any credentials transmitted via email. For organizations using SmarterMail as their primary mail platform, this represents a catastrophic data exposure.
Integrity Impact is maximum (I:H). With administrator access, the attacker can create, modify, or delete email accounts, alter server routing rules to intercept or redirect messages, modify domain settings, inject malicious content into emails, and configure the server as a spam relay. The attacker can also install additional backdoors through the administration interface to maintain persistence.
Availability Impact is maximum (A:H). The attacker can disable email services, lock out legitimate administrators by changing their passwords, delete email data, or render the server inoperable through destructive configuration changes.
Ransomware Association is Confirmed. Unlike many KEV entries where the ransomware connection is "Unknown," CISA explicitly lists the ransomware association for CVE-2026-23760 as "Known." This means ransomware operators have been confirmed to use this vulnerability as part of their attack chains. The combination of unauthenticated access, administrator-level compromise, and confirmed ransomware usage makes this vulnerability an acute threat. The EPSS score of 0.59794 (98.2nd percentile) further confirms the extreme exploitation activity.
Exploit Maturity
CVE-2026-23760 is actively exploited in the wild with confirmed ransomware association, making it one of the most urgent vulnerabilities currently tracked by CISA. The KEV catalog lists it with a remediation deadline of February 16, 2026, and explicitly marks the ransomware association as "Known," indicating confirmed use by ransomware operators.
Public Exploit Availability: Multiple public exploits and detailed technical analyses are available. watchTowr Labs published a comprehensive exploitation writeup at their blog, providing full details on how the authentication bypass works. Huntress has also published a detailed analysis covering the account takeover to RCE chain, demonstrating how the authentication bypass leads to complete server compromise including remote code execution.
Exploitation Simplicity: The vulnerability is trivially exploitable. An attacker simply sends an unauthenticated request to the force-reset-password API endpoint with a target administrator username and a new password of their choosing. No exploit toolkit, buffer overflow payload, or sophisticated technique is required. This extreme simplicity means that any attacker who can reach the SmarterMail web interface can compromise the server.
EPSS Context: The EPSS score of 0.59794 (98.2nd percentile) places this vulnerability among the most actively exploited in the current threat landscape. The combination of trivial exploitation, public exploit availability, and confirmed ransomware usage creates an immediate and severe risk for any organization running unpatched SmarterMail.
Additional Advisories: Security researchers at code-white and VulnCheck have also published advisories for this vulnerability.
Remediation
-
Upgrade SmarterMail to build 9511 or later immediately. This is the critical and only complete fix for CVE-2026-23760. The update adds proper authentication requirements to the force-reset-password endpoint, preventing anonymous password resets. Given the confirmed ransomware association and trivial exploitation, this should be treated as the highest priority. Review the SmarterMail release notes for full details.
-
Block external access to the SmarterMail administration interface as an emergency mitigation if immediate patching is not possible. Use firewall rules to restrict access to the administration port to only trusted internal IP addresses. The webmail interface for end users may need to remain accessible, but the administration endpoints should be isolated from public internet access.
-
Reset all administrator passwords after applying the patch to ensure that any passwords that may have been modified by attackers are invalidated. Also reset the passwords for all mail accounts, as an attacker with administrator access could have accessed any account. Enable multi-factor authentication for administrator accounts if SmarterMail supports it in the updated version.
-
Conduct a thorough forensic investigation to determine if the vulnerability was exploited before patching. Review SmarterMail access logs for any requests to the force-reset-password endpoint, check for unauthorized administrator logins, examine email forwarding rules for evidence of data exfiltration, and scan the server for malware or ransomware artifacts. The Huntress writeup provides detailed indicators of compromise.
-
Deploy network monitoring for SmarterMail traffic to detect ongoing exploitation attempts and post-compromise activity. Implement IDS/IPS rules that alert on requests to the force-reset-password endpoint from unauthorized sources. Monitor for unusual administrative actions, bulk email access patterns, and outbound data transfers that could indicate an attacker extracting email data.
Technical Details
CVE-2026-23760 is an authentication bypass vulnerability in SmarterTools SmarterMail affecting versions prior to build 9511. The flaw resides in the password reset API, specifically in the force-reset-password endpoint of the authentication service.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 9.8. The attack is network-based (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), and all impact dimensions are high (C:H/I:H/A:H), reflecting the complete compromise achieved through administrator account takeover.
Vulnerability Mechanism: The SmarterMail application exposes a force-reset-password API endpoint that is intended for administrative password management. However, this endpoint fails to enforce any authentication check on incoming requests. It does not require a valid session token, an existing password, a password reset token sent via email, or any other form of identity verification. An anonymous HTTP request to this endpoint that specifies a target administrator username and a desired new password is processed without challenge, effectively resetting the administrator's password to the attacker-supplied value.
Attack Chain: The exploitation proceeds in a straightforward sequence. The attacker identifies a SmarterMail instance (typically through internet scanning or reconnaissance). They then send an unauthenticated API request to the force-reset-password endpoint, specifying the system administrator username (often "admin" or a known email address) and a new password. The server resets the password without verification. The attacker logs in with the new credentials, gaining full administrative access. From this position, as documented by Huntress, the attacker can leverage administrative features to achieve remote code execution on the underlying server.
Design Flaw Analysis: The fundamental issue is that a sensitive administrative operation (password reset) was exposed through an API endpoint without any access control. The endpoint appears to have been designed for internal administrative use but was accessible through the public-facing web interface. This represents a classic authentication bypass via an alternate path, where a function meant for privileged use is reachable by unauthenticated users.
Frequently Asked Questions
What is CVE-2026-23760?
CVE-2026-23760 is a critical authentication bypass vulnerability in SmarterTools SmarterMail that allows an unauthenticated attacker to reset administrator passwords through the force-reset-password API endpoint. It has a CVSS score of 9.8 and is confirmed by CISA to be associated with ransomware campaigns.
Is CVE-2026-23760 being used in ransomware attacks?
Yes. CISA explicitly lists the ransomware association as "Known," confirming that ransomware operators are using this vulnerability in their attack campaigns. This makes immediate patching critical for any organization running an affected SmarterMail version.
How does CVE-2026-23760 relate to CVE-2025-52691?
Both vulnerabilities affect SmarterTools SmarterMail and are listed in CISA's KEV catalog with the same remediation deadline. CVE-2025-52691 is an unrestricted file upload vulnerability, while CVE-2026-23760 is an authentication bypass. Together, they represent multiple critical attack vectors against SmarterMail. Organizations should update to at least build 9511 to address both vulnerabilities.
What is the minimum safe version of SmarterMail?
SmarterMail build 9511 or later addresses CVE-2026-23760 (the authentication bypass). Note that CVE-2025-52691 (the file upload vulnerability) was fixed in build 9413. To be fully protected against both known exploited vulnerabilities, organizations should run build 9511 or later.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.