Reset the SmarterMail Admin Password, Then Take the Server
SmarterMail CVE-2026-23760 exposed an anonymous password-reset endpoint that let an attacker choose an administrator account and set a new password. Built-in server functionality could then provide operating-system command execution.
The authentication bypass affects builds before 9511. A second vulnerability, CVE-2026-24423, provides a separate unauthenticated remote-code-execution path in vulnerable SmarterMail systems. Both were reported as actively exploited.
watchTowr’s analysis showed why the first issue was so dangerous. The exposed API accepted attacker-controlled values for the username, new password and system-administrator flag without proving the caller knew the old password. A successful reset gave the attacker the same legitimate control surface used by the server owner.
Two vulnerabilities, two routes to control
| Vulnerability | Impact and prerequisites | Fixed version and exploitation |
|---|---|---|
| CVE-2026-23760 | Unauthenticated system-administrator password reset through an exposed API. No old password is required. Administrative functions can then be used to reach SYSTEM-level execution. | Fixed in build 9511. CISA added it to KEV on 26 January 2026. |
| CVE-2026-24423 | Separate unauthenticated remote code execution in vulnerable SmarterMail deployments. | Fixed in build 9511. NCSC-NL and Check Point reported active exploitation. |
Administrative features completed the attack
After resetting a system administrator, an attacker did not need a second memory-corruption exploit. SmarterMail already provided powerful server-management functions. watchTowr demonstrated how a built-in volume-mount capability could be pointed at attacker-controlled infrastructure and used to execute commands with SYSTEM privileges.
This is a recurring enterprise-software pattern. Authentication bypass changes who may use a legitimate administrative feature. The feature then supplies the post-authentication capability the attacker needs. The first bug crosses the identity boundary; the product’s intended power creates the impact.
SmarterTools released build 9511 on 15 January, shortly after receiving the initial report. Public evidence of exploitation appeared within days. That compressed timeline left little room for organisations that treated mail-server updates as ordinary maintenance.
What defenders should do
- Upgrade to build 9511 or later. Confirm the running build after the service restarts.
- Audit every system administrator. Review newly created accounts, password changes, privilege modifications and MFA enrolments.
- Inspect API access. Search web and application logs for calls to the force-reset endpoint and other anonymous authentication routes.
- Hunt for command execution. Examine child processes, mounted resources, scripts, scheduled tasks, services and outbound connections from the SmarterMail host.
- Review the separate RCE path. Do not assume the absence of an administrator reset rules out exploitation of the second vulnerability.
- Rotate mail and infrastructure secrets after scoping. A system-level intruder may have accessed certificates, credentials, mailboxes and configuration data.
The BlackTree view
The most dangerous line in the chain was not exotic. It was the moment an anonymous caller became the mail server’s administrator. Everything after that looked like authorised product use from an identity that should never have existed.
Internet-facing mail infrastructure deserves emergency treatment when an authentication bypass lands. The server is already connected to users, credentials and sensitive communications. A built-in management action can be enough to turn that position into full control.
Sources and publication details
- watchTowr Labs: SmarterMail authentication bypass analysis, published in January 2026. The page timeline records discovery on 8 January, the fixed build on 15 January and exploitation evidence on 17 January. No publication time was provided.
- NVD entry for the SmarterMail administrator-reset vulnerability, accessed 1 September 2026.
- NCSC-NL advisory NCSC-2026-0040, published 6 February 2026 at 10:25 Europe/Amsterdam time.
- Check Point advisory CPAI-2026-0685, accessed 1 September 2026.
