CVE-2026-23760

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 96.5%

Published22 Jan 2026
Added to CISA KEV26 Jan 2026
Remediation due16 Feb 2026

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

Added to KEV: 26 Jan 2026Federal remediation due: 16 Feb 2026Used in ransomware

Description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Smartertools Smartermail< 100.0.9511

Remediation

Fixed in

Smartertools Smartermail≥ 100.0.9511

References

https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermailThird Party Advisory
https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760US Government Resource
https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rceExploitThird Party Advisory
https://www.smartertools.com/smartermail/release-notes/currentRelease Notes
https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-apiThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-23760 being actively exploited?

Yes. CVE-2026-23760 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 Jan 2026. It has been used in ransomware campaigns.

How severe is CVE-2026-23760?

CVE-2026-23760 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 96.5% probability of exploitation.

Which products are affected by CVE-2026-23760?

Affected products include Smartertools Smartermail.

How do I fix CVE-2026-23760?

Upgrade affected software to a fixed version, for example Smartertools Smartermail 100.0.9511 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-23760 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.