MSRXSmarterTools vulnerabilities being exploited
3 SmarterTools flaws were confirmed exploited in the wild in the past 365 days, 3 used in ransomware, across 1 product: SmarterMail. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-02-05 | CVE-2026-24423 SmarterMail ransomwareSmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. | 2026-02-26 |
| 2026-01-26 | CVE-2026-23760 SmarterMail ransomwareSmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. | 2026-02-16 |
| 2026-01-26 | CVE-2025-52691 SmarterMail ransomwareSmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. | 2026-02-16 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.