CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

SmarterTools SmarterMail contains an authentication bypass in its password reset API. An unauthenticated attacker can supply an administrator username and a new password through the force-reset-password endpoint, gaining full administrative control of the instance. The flaw matters because administrative compromise of an email server typically grants access to all user mailboxes, configuration data, and connected systems.

How it works

The weakness is classified as CWE-288, authentication bypass using an alternate path or channel. The affected endpoint accepts anonymous requests and performs the reset without validating an existing password or a legitimate reset token when the target account holds system administrator privileges. An attacker therefore needs only network access to the API and knowledge of a valid administrator username.

Am I affected? How to find it in your systems

SmarterMail functions as an on-premises or self-hosted email server. Locate all instances by querying asset inventories, network scans, or configuration management databases for the SmarterMail service or its default ports. Review installed versions and exposed management interfaces against the vendor advisory to determine whether the password-reset API is reachable from untrusted networks. No specific log signatures are provided in public sources; monitor authentication and API request logs for unexpected password changes on administrator accounts and confirm details with the vendor advisory.

How to remediate

Apply the vendor-supplied update that addresses the force-reset-password endpoint. After patching, restrict administrative interfaces to trusted management networks and enforce multi-factor authentication for all administrator accounts where supported. Review API access controls to ensure password-reset operations require authenticated sessions or verified tokens.

If you can't patch immediately

Place the SmarterMail server behind a network segmentation boundary that blocks direct access from untrusted sources to the management API. Disable or restrict the password-reset feature if the vendor permits it, or apply virtual patching through a web application firewall that inspects and blocks anonymous requests to the force-reset-password path. Increase monitoring of administrator account changes and retain logs for at least 90 days. Because the vulnerability is known to be used in ransomware campaigns, treat any detected exploitation as a potential precursor to data encryption or exfiltration.

If your data may have been exposed

Actively exploited vulnerabilities of this type frequently lead to breaches. You can run a free exposure scan of your email addresses against known breach data to check for prior compromise.