← Vulnerability feed

Vulnerability record · CVE-2026-40514 · published 27 April 2026

CVE-2026-40514: Smartertools smartermail vulnerability

Smartertools · Smartermail

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

8.2 CVSS 4.0 High EPSS 0.26% · top 83.8% CWE-338 · CWE-338
8.2CVSS 4.0 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.smartertools.com/smartermail/release-notes/current Release Notes
https://www.vulncheck.com/advisories/smartertools-smartermail-build-9610-cryptographic-weakness-via-weak-rng Third Party Advisory

Track CVE-2026-40514 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-52691SmarterMail unauthenticated arbitrary file upload leading to RCESmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434) that lets an unauthenticated attacker write files to any location on the…KEVEPSS 86%analysed9.3CVE-2026-24423SmarterMail ConnectToHub API unauthenticated remote code executionSmarterTools SmarterMail builds prior to 9511 expose the ConnectToHub API method without authentication, allowing an attacker to redirect the applica…KEVEPSS 88%analysed9.3CVE-2026-23760SmarterMail password reset API authentication bypassSmarterMail builds prior to 9511 expose a force-reset-password endpoint that accepts anonymous requests and does not verify the current password or a…KEVEPSS 97%analysed9.8CVE-2021-32234Smartertools smartermail vulnerabilitySmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.EPSS 2.2%9.8CVE-2019-7214SmarterMail deserialization of untrusted data enables unauthenticated RCESmarterTools SmarterMail 16.x before build 6985 deserializes untrusted data, letting an unauthenticated attacker execute commands on the server when …EPSS 85%analysed8.7CVE-2026-7807Smartertools smartermail path traversal vulnerabilitySmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that all…EPSS 0.34%8.2CVE-2019-7212Smartertools smartermail hard-coded credentials vulnerabilitySmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file atta…EPSS 1.0%8.1CVE-2020-29548Smartertools smartermail command injection vulnerabilityAn issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS comma…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2026-40514), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.