CVE-2026-23760
Authentication Bypass Using an Alternate Path or Channel in SmarterTools SmarterMail. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 26 January 2026.
- Product
- SmarterTools SmarterMail
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- Known to be used in ransomware
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
More from SmarterTools this year.
- CVE-2026-24423 Missing Authentication for Critical Function, added
- CVE-2025-52691 Unrestricted Upload of File with Dangerous Type, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.