Full Report
SmarterMail versions prior to Build 9511 are vulnerable to privileged account takeover and remote code execution. Learn more about the latest Huntress DE&TH Team’s findings.
Analysis Summary
# Vulnerability: SmarterMail Privileged Account Takeover and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-23760
- **CVSS Score:** Not explicitly listed in the report, but characterized as "Critical" due to unauthorized privileged access and RCE.
- **CWE:** CWE-287 (Improper Authentication / Authentication Bypass)
## Affected Systems
- **Products:** SmarterTools SmarterMail
- **Versions:** All versions prior to **Build 9511** (specifically confirmed in builds up to 9504).
- **Configurations:** Systems where the SmarterMail web interface/API is accessible via the network.
## Vulnerability Description
The vulnerability exists in the SmarterMail API endpoint `/api/v1/auth/force-reset-password`. The application failed to validate if the "old password" submitted during a reset request was correct or if the requester was authorized to perform the action.
This flaw allows an unauthenticated attacker to reset the password of any user, including administrative accounts. Once administrative access is gained, attackers leverage the **System Events** functionality to achieve Remote Code Execution (RCE) by configuring malicious event hooks that execute operating system commands when triggered (e.g., when a new domain is added).
## Exploitation
- **Status:** **Exploited in the wild.** Mass automated exploitation has been observed by the Huntress DE&TH team.
- **Complexity:** Low
- **Attack Vector:** Network
- **PoC Availability:** Validated by Huntress and WatchTowr; technical details of the exploit chain are publicly documented.
## Impact
- **Confidentiality:** High (Full access to all mailboxes and system data)
- **Integrity:** High (Ability to modify system configurations and execute arbitrary code)
- **Availability:** High (Potential for system disruption or total takeover)
## Remediation
### Patches
- **Upgrade to SmarterMail Build 9511** (Released January 15, 2026) or later. This version introduces proper validation for the password reset logic.
### Workarounds
- There are no specific software workarounds provided; immediate patching is the primary recommendation.
- Restricting access to the SmarterMail administration interface to trusted IP addresses only may reduce the attack surface.
## Detection
### Indicators of Compromise (IoCs)
**Observed Attacker IP Addresses:**
- 142.111.152[.]57
- 142.111.152[.]229
- 155.2.215[.]66
- 142.111.152[.]54
- 142.111.152[.]53
- 142.111.152[.]222
- 142.111.152[.]159
- 142.111.152[.]165
- 155.2.215[.]70
### Detection Methods
- **Log Analysis:** Search SmarterMail application logs for suspicious sequences of HTTP POST requests:
1. `POST /api/v1/auth/force-reset-password` (without prior authorized session)
2. `POST /api/v1/settings/sysadmin/event-hook` (creation of new hooks)
3. `POST /api/v1/settings/sysadmin/domain-put` (triggering the hook)
- **System Event Audit:** Review SmarterMail configuration for unauthorized "System Events" or "Event Hooks" that execute shell commands or external scripts.
## References
- **Vendor Patch:** [https://www.smartertools.com/smartermail/release-notes/current] (Defanged)
- **Huntress Blog:** hxxps://www[.]huntress[.]com/blog/smartermail-account-takeover-leading-to-rce
- **WatchTowr Analysis:** hxxps://labs[.]watchtowr[.]com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/
- **Related Vulnerability:** CVE-2025-52691 (Arbitrary File Upload in SmarterMail)