Active Exploitation of SmarterMail Authentication Bypass Leading to Admin Takeover and RCE

Internet-wide scanning identified 6,000+ SmarterTools SmarterMail servers exposed online and likely vulnerable to CVE-2026-23760, a critical authentication bypass in the password reset API that enables unauthenticated admin account takeover and can lead to remote code execution. The flaw affects SmarterMail versions prior to build 9511 and abuses the /api/v1/auth/force-reset-password (aka force-reset-password) endpoint, which allows anonymous password resets for administrator accounts without validating the existing password or requiring a reset token. SmarterTools issued a fix on January 15, 2026 (later assigned CVE-2026-23760), and Shadowserver reported large-scale exposure with thousands of instances flagged as “likely vulnerable,” including heavy concentration in North America and additional exposure in Asia.

Multiple sources reported active exploitation shortly after patch availability, with observed attacker behavior consistent with automated hijacking: resetting admin credentials, obtaining authenticated access, and then leveraging SmarterMail administrative capabilities to execute OS-level commands. Huntress reported attackers creating malicious System Events to run reconnaissance commands and establish persistence, while watchTowr (which reported the issue to SmarterTools) received additional reports of exploitation in production environments. The reporting also notes this disclosure follows closely after another critical pre-auth SmarterMail issue (CVE-2025-52691), reinforcing that unpatched, internet-exposed SmarterMail deployments are being actively targeted.