CVE-2026-23760: SmarterMail password reset API authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass leading to full administrative and host-level compromise, with KEV listing, ransomware association, and near-certain EPSS score.

What it is

SmarterMail builds prior to 9511 expose a force-reset-password endpoint that accepts anonymous requests and does not verify the current password or a reset token when resetting system administrator accounts. An unauthenticated attacker who knows an administrator username can set a new password and take over the instance. Because SmarterMail system administrator privileges allow OS command execution through built-in management features, the flaw escalates to host-level compromise.

Impact

An attacker gains full administrative control of the SmarterMail instance and, via built-in management functionality, can execute operating system commands as SYSTEM or root on the underlying host. This enables complete compromise of mail data and the server itself.

Attack surface

Reachable over the network through the password reset API; the CVSS 4.0 vector shows no privileges required and no user interaction (PR:N/UI:N). The attacker only needs to supply a target administrator username and a new password to the force-reset-password endpoint.

Exploitation

CVE-2026-23760 is listed in CISA KEV with a due date of 2026-02-16 and is flagged for known ransomware campaign use, and EPSS gives a 30-day probability of 0.96438 (99.878th percentile). Multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade SmarterMail to build 9511 or later immediately; this is the only complete fix.
• If patching cannot be done at once, restrict network access to the SmarterMail web and API interfaces to trusted sources and disable or block the force-reset-password endpoint at the reverse proxy or WAF.
• Rotate credentials and review all system administrator accounts for unauthorized password changes or newly created admin accounts.
• Apply the vendor mitigations referenced in the CISA KEV entry and follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Monitor for and investigate any signs of post-exploitation OS command execution through SmarterMail management features.

Detection

• Audit SmarterMail logs for anonymous or unauthenticated requests to the force-reset-password endpoint, especially those targeting administrator usernames.
• Alert on administrator password reset events that lack a corresponding authenticated session or valid reset token.
• Monitor for unexpected changes to system administrator accounts, including new admin creation or password changes outside change windows.
• Hunt for suspicious child processes or command execution spawned by the SmarterMail service on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.