CVE-2025-52691: SmarterMail unauthenticated arbitrary file upload leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable file upload leading to RCE, CVSS 10.0, active exploitation in CISA KEV with known ransomware use and very high EPSS.

What it is

SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434) that lets an unauthenticated attacker write files to any location on the mail server. Because uploaded files can land anywhere, the flaw can escalate to remote code execution, making it a full compromise of the mail server. It is under active exploitation and listed in CISA KEV.

Impact

An unauthenticated attacker can place arbitrary files anywhere on the server and achieve remote code execution, gaining control of the mail server and any data or credentials it holds.

Attack surface

Reachable over the network via the mail server's upload handling with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The record does not specify the exact endpoint or parameter.

Exploitation

CISA KEV lists it as exploited with known ransomware campaign use, and a public proof-of-concept exploit exists (watchTowr reference tagged Exploit). EPSS is 0.857 (99.7th percentile), indicating very high near-term exploitation likelihood.

What to do

• Apply the vendor's patch or mitigation instructions for SmarterMail immediately; if none is available, discontinue use of the product per CISA guidance.
• Restrict network access to the SmarterMail web interface to trusted sources and block untrusted inbound traffic until patched.
• Enforce the CISA KEV remediation due date of 2026-02-16 and follow BOD 22-01 guidance for cloud-hosted instances.
• Audit the mail server for unexpected or recently written files, especially in web-accessible and executable paths.
• Rotate credentials and secrets stored on or accessible from the mail server in case of prior compromise.

Detection

• Monitor for file creation events in web roots, application directories and other unusual paths on the SmarterMail host.
• Alert on upload requests to SmarterMail endpoints from unauthenticated or anomalous sources, and on subsequent execution of newly written files.
• Hunt for webshell-like or executable files with recent timestamps in mail server directories.
• Review server and web logs for upload activity preceding process creation or outbound connections from the mail server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.