internet-facing-service-vulnerabilityproof-of-concept-releaseinternet-exposed-servicerapid-weaponization

SmarterMail Unauthenticated File Upload RCE (CVE-2025-52691) Exposes Thousands of Internet-Facing Servers

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jan 14, 2026

A critical SmarterTools SmarterMail vulnerability, CVE-2025-52691, enables remote code execution (RCE) via an unauthenticated arbitrary file upload condition (CWE-434). The issue affects SmarterMail Build 9406 and earlier and is fixed in Build 9413 and later; the NVD lists a CVSS v3.1 score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Successful exploitation can allow full server compromise, including webshell deployment, data theft, and lateral movement under the service’s privileges.

Internet-wide scanning reported 8,001 likely vulnerable IPs out of 18,783 exposed SmarterMail instances (about 42.6% failing checks), with the largest concentration in the United States (~5,000) followed by the UK and Malaysia. Public proof-of-concept exploit code is available, increasing the likelihood of opportunistic exploitation against unpatched, internet-facing deployments; multiple national agencies reportedly issued advisories following disclosure in late December 2025.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 12, 2026 – Jan 13, 2026

Jan 13, 202610mo ago
Admins urged to upgrade SmarterMail to patched builds
Security reporting advised administrators to upgrade to SmarterMail Build 9413 or later, preferably Build 9483, and to apply interim mitigations such as restricting admin access and monitoring for suspicious uploads. This guidance was issued in response to the continued exposure of vulnerable internet-facing servers.
Jan 13, 202610mo ago
Public PoC exploit for CVE-2025-52691 becomes available
Public proof-of-concept exploit code was released for CVE-2025-52691, including examples such as ASPX webshell-based remote code execution. The availability of simple PoCs increased the risk of opportunistic attacks against exposed servers.
Jan 13, 202610mo ago
SmarterMail RCE flaw CVE-2025-52691 is identified
A critical unauthenticated arbitrary file upload vulnerability, tracked as CVE-2025-52691, was identified in SmarterTools SmarterMail. The flaw affects Build 9406 and earlier and can lead to remote code execution under the service's privileges.
Jan 12, 202610mo ago
Internet scan finds 8,000+ exposed SmarterMail servers still vulnerable
Internet-wide scans conducted on January 12, 2026 found more than 8,000 internet-exposed SmarterMail servers still vulnerable to CVE-2025-52691. Shadowserver UK and Censys data indicated widespread exposure, with the United States hosting the largest number of affected instances.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Arbitrary File Upload in SmarterTools SmarterMail (CVE-2025-52691)

Affected products

1 linked

Smartermail

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Horizon3 BlogNews · Jan 14, 2026

HPE OneView RCE (CVE-2025-37164) | CISA KEV | Horizon3.aiOpen source ↗

Cyber Security NewsNews · Jan 13, 2026

8000+ SmarterMail Hosts Vulnerable to RCE Attack - PoC Exploit ReleasedOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilityproof-of-concept-releaseinternet-exposed-servicerapid-weaponization

SmarterMail Unauthenticated File Upload RCE (CVE-2025-52691) Exposes Thousands of Internet-Facing Servers

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jan 14, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 12, 2026 – Jan 13, 2026

Jan 13, 202610mo ago
Admins urged to upgrade SmarterMail to patched builds
Security reporting advised administrators to upgrade to SmarterMail Build 9413 or later, preferably Build 9483, and to apply interim mitigations such as restricting admin access and monitoring for suspicious uploads. This guidance was issued in response to the continued exposure of vulnerable internet-facing servers.
Jan 13, 202610mo ago
Public PoC exploit for CVE-2025-52691 becomes available
Public proof-of-concept exploit code was released for CVE-2025-52691, including examples such as ASPX webshell-based remote code execution. The availability of simple PoCs increased the risk of opportunistic attacks against exposed servers.
Jan 13, 202610mo ago
SmarterMail RCE flaw CVE-2025-52691 is identified
A critical unauthenticated arbitrary file upload vulnerability, tracked as CVE-2025-52691, was identified in SmarterTools SmarterMail. The flaw affects Build 9406 and earlier and can lead to remote code execution under the service's privileges.
Jan 12, 202610mo ago
Internet scan finds 8,000+ exposed SmarterMail servers still vulnerable
Internet-wide scans conducted on January 12, 2026 found more than 8,000 internet-exposed SmarterMail servers still vulnerable to CVE-2025-52691. Shadowserver UK and Censys data indicated widespread exposure, with the United States hosting the largest number of affected instances.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Arbitrary File Upload in SmarterTools SmarterMail (CVE-2025-52691)

Affected products

1 linked

Smartermail

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Horizon3 BlogNews · Jan 14, 2026

HPE OneView RCE (CVE-2025-37164) | CISA KEV | Horizon3.aiOpen source ↗

Cyber Security NewsNews · Jan 13, 2026

8000+ SmarterMail Hosts Vulnerable to RCE Attack - PoC Exploit ReleasedOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

SmarterMail Unauthenticated File Upload RCE (CVE-2025-52691) Exposes Thousands of Internet-Facing Servers

How this story unfolded

Admins urged to upgrade SmarterMail to patched builds

Public PoC exploit for CVE-2025-52691 becomes available

SmarterMail RCE flaw CVE-2025-52691 is identified

Internet scan finds 8,000+ exposed SmarterMail servers still vulnerable

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

SmarterMail Flaws Expose Email Servers to Authentication Bypass and RCE

Critical SmarterMail Vulnerability Allowing Unauthenticated Arbitrary File Upload (CVE-2025-52691)

Critical Remote Code Execution Vulnerability in SmarterMail

SmarterMail Unauthenticated File Upload RCE (CVE-2025-52691) Exposes Thousands of Internet-Facing Servers

How this story unfolded

Admins urged to upgrade SmarterMail to patched builds

Public PoC exploit for CVE-2025-52691 becomes available

SmarterMail RCE flaw CVE-2025-52691 is identified

Internet scan finds 8,000+ exposed SmarterMail servers still vulnerable

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

SmarterMail Flaws Expose Email Servers to Authentication Bypass and RCE

Critical SmarterMail Vulnerability Allowing Unauthenticated Arbitrary File Upload (CVE-2025-52691)

Critical Remote Code Execution Vulnerability in SmarterMail