SmarterMail Flaws Expose Email Servers to Authentication Bypass and RCE

Multiple severe vulnerabilities in SmarterMail exposed internet-facing mail servers to compromise, including CVE-2025-52691, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and CVE-2026-23760, an authentication bypass tied to the password reset API. Public reporting said CVE-2025-52691 affected Build 9406 and earlier, carried a CVSS 10.0 rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service.

Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for CVE-2026-23760 increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in Build 9413, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.