CVE entry · CVE-2026-23760
CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
- Actively exploited: added to CISA’s KEV catalog on January 26, 2026.
- Used by ransomware, according to CISA.
- Remediation deadline for US federal agencies: February 16, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes SmarterTools SmarterMail, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (www.smartertools.com)
- NVD entry (NIST)
- CISA KEV catalog