CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 96.5% chance of exploitation in the next 30 days.

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Affected products

• SmarterTools SmarterMail: before 100.0.9511 (fixed in 100.0.9511)

Published 2026-01-22. Last modified 2026-08-04.