Smartertools

Vulnerability activity for Smartertools: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 4
Critical (CVSS 9+): 3
Exploited (CISA KEV): 3
With exploit code: 3

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.3CriticalFeb 5, 2026SmarterTools SmarterMail Auth bypass / access controlCVE-2026-24423SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to KEV Feb 5, 2026Exploited88% likelyExploit codeNucleiDetection
9.3CriticalJan 26, 2026SmarterTools SmarterMail Auth bypass / access controlCVE-2026-23760SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.Added to KEV Jan 26, 2026Exploited96% likelyExploit codeNucleiDetection
10.0CriticalJan 26, 2026SmarterTools SmarterMail Path traversal / file handlingCVE-2025-52691SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.Added to KEV Jan 26, 2026Exploited86% likelyExploit codeMetasploit · NucleiDetection

Recent

8.1HighMay 8, 2026Smartertools smartermail Path traversal / file handlingCVE-2026-7807SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
9.3CriticalFeb 5, 2026SmarterTools SmarterMail Auth bypass / access controlCVE-2026-24423SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Exploited88% likelyExploit codeNucleiDetection
10.0CriticalJan 26, 2026SmarterTools SmarterMail Path traversal / file handlingCVE-2025-52691SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.Exploited86% likelyExploit codeMetasploit · NucleiDetection
9.3CriticalJan 26, 2026SmarterTools SmarterMail Auth bypass / access controlCVE-2026-23760SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.Exploited96% likelyExploit codeNucleiDetection

See every Smartertools entry on the dashboard.