Loading story…
SmarterTools released SmarterMail Build 9511 to address multiple security issues, including a critical unauthenticated RCE in the ConnectToHub API method tracked as CVE-2026-24423 (CVSS 9.3). The flaw allows an attacker to direct SmarterMail to an attacker-controlled HTTP server that returns a malicious OS command, which the application then executes. The same build also fixes another critical issue, CVE-2026-23760 (CVSS 9.3), which has been reported as actively exploited in the wild, and a medium-severity issue CVE-2026-25067 (CVSS 6.9) described as unauthenticated path coercion that can trigger outbound SMB authentication to attacker-controlled UNC paths, enabling credential coercion/NTLM relay scenarios.
Separately, a proof-of-concept exploit was reported for an older critical RCE in GNU InetUtils telnetd tracked as CVE-2026-24061, raising the likelihood of broad compromise across an estimated 800,000+ internet-exposed instances. The Shadowserver Foundation reported the largest concentrations of exposed legacy deployments in China, followed by Brazil, the U.S., Japan, and Mexico, and urged organizations to audit for exposed telnet services (commonly 23/TCP), disable telnetd, enforce firewall restrictions, and migrate to SSH to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-27, The Shadowserver Foundation found that more than 800,000 internet-exposed GNU InetUtils telnetd instances were potentially vulnerable to CVE-2026-24061, with the largest exposure concentrated in China, followed by Brazil, the United States, Japan, and Mexico.
By 2026-01-27, reporting indicated that a proof-of-concept exploit for CVE-2026-24061, a critical remote code execution flaw in GNU InetUtils telnetd, was available, increasing the likelihood of compromise for more than 800,000 internet-exposed instances.
On 2026-01-22, SmarterTools released SmarterMail Build 9518 to patch CVE-2026-25067, a medium-severity unauthenticated path coercion issue that could enable NTLM relay and unauthorized outbound SMB authentication to attacker-controlled hosts.
On 2026-01-15, SmarterTools released SmarterMail Build 9511 to fix multiple vulnerabilities, including the critical unauthenticated RCE flaw CVE-2026-24423 and CVE-2026-23760, which had been observed under active exploitation in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026
A critical SmarterTools *SmarterMail* vulnerability, **CVE-2025-52691**, enables **remote code execution (RCE)** via an **unauthenticated arbitrary file upload** condition (CWE-434). The issue affects SmarterMail **Build 9406 and earlier** and is fixed in **Build 9413 and later**; the NVD lists a **CVSS v3.1 score of 10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation can allow full server compromise, including webshell deployment, data theft, and lateral movement under the service’s privileges. Internet-wide scanning reported **8,001 likely vulnerable IPs** out of **18,783** exposed SmarterMail instances (about **42.6%** failing checks), with the largest concentration in the **United States (~5,000)** followed by the **UK** and **Malaysia**. **Public proof-of-concept exploit code** is available, increasing the likelihood of opportunistic exploitation against unpatched, internet-facing deployments; multiple national agencies reportedly issued advisories following disclosure in late December 2025.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-52691, has been identified in SmarterMail, affecting Build 9406 and earlier. This flaw allows unauthenticated attackers to upload arbitrary files to any location on the mail server, enabling them to execute remote code and potentially gain full control over compromised systems. The vulnerability has been assigned a CVSS score of 10.0, indicating maximum severity, and poses a significant risk of unauthorized access, data exfiltration, malware deployment, and lateral movement within affected networks. SmarterTools has released Build 9413 to address this issue, and immediate patching is strongly advised to mitigate the threat. The vulnerability was discovered by Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT), with responsible disclosure coordinated by the Cyber Security Agency (CSA) of Singapore. Security advisories from both SmarterTools and the Canadian Centre for Cyber Security urge all users and administrators to verify their SmarterMail version and apply the update to Build 9413 or later without delay. Failure to patch leaves organizations exposed to active exploitation and potential compromise of sensitive email communications and infrastructure.
Jun 29, 2026