SmarterTools' SmarterMail product had three separate vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue within a single eleven-day window, and all three are independently sufficient for an unauthenticated attacker to take over a mail server — one via remote code execution, one via arbitrary file upload, and one via a password-reset flow that hands over the administrator account outright. All three also carry a "Known" ransomware campaign use flag.
| CVE | CVSS | Flaw | Added to KEV |
|---|---|---|---|
| CVE-2025-52691 | 10.0 | Unrestricted file upload | 26 Jan 2026 |
| CVE-2026-23760 | 9.8 | Admin password-reset auth bypass | 26 Jan 2026 |
| CVE-2026-24423 | 9.8 | ConnectToHub API missing auth | 5 Feb 2026 |
Why three roads to the same destination is worse than one
Each of these three CVEs would, on its own, be a headline-grade finding. Together, they describe a mail server where an unauthenticated attacker has three independent, unrelated paths to full compromise, which matters because it eliminates the usual mitigation of "patch the one flaw and you're covered." CVE-2025-52691 is an unrestricted file upload vulnerability that lets an unauthenticated attacker write arbitrary files to any location on the mail server — a textbook path to planting a web shell or malicious executable, and it carries a perfect CVSS 10.0 with a changed scope (S:C), meaning the impact isn't contained to the vulnerable component itself.
CVE-2026-23760 is arguably the most alarming of the three because of how directly it maps to attacker intent: the force-reset-password endpoint in SmarterMail's password reset API permits anonymous requests and fails to verify either the existing password or a reset token when the target is a system administrator account. An unauthenticated attacker simply supplies a target admin username and a new password of their choosing. NVD's own note on this CVE spells out why that's catastrophic rather than merely bad — SmarterMail administrator privileges include the ability to execute operating system commands via built-in management functionality, which means resetting the admin password is functionally equivalent to remote code execution as SYSTEM or root on the underlying host.
CVE-2026-24423 rounds out the trio with a missing-authentication flaw in the ConnectToHub API method: an attacker can point the SmarterMail instance at a malicious HTTP server that serves back an OS command for execution, again with no authentication required. Three different subsystems — file handling, password reset, and the ConnectToHub API — all failing to enforce authentication or validate input in ways that converge on the same outcome (full server compromise) points to authentication and authorization being treated as separable, bolt-on concerns in the product's architecture rather than a consistent boundary enforced everywhere data enters the application.
What to check this week
Patch to build 9511 or later immediately — CVE-2026-24423 and CVE-2026-23760 are both explicitly described as affecting versions prior to build 9511, and given the "Known" ransomware use across this entire cluster, treat any unpatched instance as already compromised until verified otherwise.
Reset all administrator credentials after patching, not just the vulnerable component — if CVE-2026-23760 was exploitable before your patch landed, an attacker may already hold a valid admin session or password regardless of the underlying flaw being fixed.
Review file system integrity on the mail server host for unexpected files in any web-accessible directory, since CVE-2025-52691's arbitrary-location upload could have planted a persistence mechanism well before detection.
Restrict network exposure of the mail server's administrative interfaces to known management networks where feasible, reducing the blast radius of any future authentication-related finding in this product line.
Why the "Known" ransomware flag across all three is the signal to act on
Unlike vulnerability clusters where ransomware use is unknown or unconfirmed, all three SmarterMail CVEs here carry a "Known" designation for ransomware campaign use — meaning CISA has evidence tying exploitation of this specific product to ransomware operations, not merely opportunistic access. Mail servers are a particularly valuable ransomware target because they sit at the center of an organization's identity and communication fabric; compromising one often yields not just the server itself but a foothold for further phishing, credential harvesting, and lateral movement using the trust that email carries internally.
A closing note on email infrastructure as crown-jewel infrastructure
Mail servers rarely get the same security attention as internet-facing web applications, in part because they're perceived as "just" infrastructure rather than a product surface. This cluster is a reminder that mail infrastructure often holds more sensitive material — password resets, internal communications, attachment archives — than the applications it's overshadowed by in most security programs, and three KEV entries in eleven days for the same product is a strong signal that this perception gap needs correcting.
How Safeguard helps
Safeguard's continuous inventory identifies mail server software like SmarterMail across an organization's estate and tracks patch currency against exactly this kind of multi-CVE cluster, so that three vulnerabilities landing in the same short window register as one urgent, compounding risk rather than three separate line items competing for attention against unrelated findings elsewhere in the environment.
