SmarterTools SmarterMail Admin Password Reset (CVE-2026-23760)
Severity:
Critical
Summary
SmarterTools SmarterMail contains an unauthenticated administrative password reset vulnerability. The application exposes an API endpoint that accepts password reset requests without verifying a secret. By sending a crafted POST request with a target username and desired password, a remote unauthenticated attacker can overwrite the administrator's credentials, gaining full control over the mail server administration interface.
Impact
An unauthenticated attacker can fully compromise the SmarterMail by resetting the administrator password.
Remediation
Upgrade SmarterMail to the latest patched version and ensure all security updates are applied regularly.
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Related Vulnerabilities
Featured resources
Build your resistance to threats. And save hundreds of hours each month.
