Loading story…
ZTE patched four vulnerabilities in its SmartLife mobile app and cloud-account backend that could enable fraudulent registration, email and account enumeration, server-information exposure, and takeover of connected-home accounts. The most severe issue, CVE-2026-86553 (CVSS 8.8), allowed a password-reset request containing a target backend account ID and a new password to succeed without validating a reset code, prior password, or other proof that the requester controlled the account.
Attackers could pair the reset flaw with CVE-2026-86554, which revealed whether an email address was registered and returned its associated backend account ID, creating a path from a known email address to a valid authenticated session. The reported proof of concept used researcher-controlled accounts and confirmed that the original password was invalidated after reset. ZTE assigned CVE-2026-86552 through CVE-2026-86555, confirmed patches for all four issues, and advised users to update SmartLife and review account passwords, connected devices, and shared-home permissions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
ZTE remediated CVE-2026-86552 through CVE-2026-86555, including CVE-2026-86553, an unverified password-reset flaw, and CVE-2026-86554, an email and backend account-ID disclosure issue. ZTE issued advisories for the four vulnerabilities on this date.
Researcher Mina Nageh Salama identified four vulnerabilities in ZTE SmartLife and its cloud-account services, including an account-takeover chain that combined email/account-ID disclosure with an unverified password reset. The password-reset behavior was validated only using researcher-controlled accounts, where the replacement password successfully authenticated and the previous password no longer worked.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceminanagehsalalma.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**watchTowr Labs** disclosed **WT-2026-0001**, an **authentication bypass** in *SmarterTools SmarterMail* that allows a user to reset the **system administrator password** via a password-reset mechanism and then leverage SmarterMail’s built-in “RCE-as-a-feature” capabilities to execute OS commands. The researcher reported the issue and stated it was patched quickly, citing a fixed release on **SmarterMail release 9511 (2026-01-15)**; the publication was accelerated after a tip that attackers were actively exploiting the flaw to reset admin passwords, with forum-shared logs reportedly showing suspicious activity tied to the `force-reset-password` endpoint. **Resecurity** reported exploitation of **CVE-2026-22794** in *Appsmith*, a critical authentication weakness in the password reset flow where the application trusts a **client-controlled `Origin` header** to build reset links. An attacker can initiate a reset for a victim while supplying a malicious Origin so the victim’s email contains a link to attacker infrastructure; when clicked, the reset token is exposed, enabling password change and **full account takeover**. Resecurity identified the affected endpoint as `/api/v1/users/forgotPassword`, stated **Appsmith ≤ 1.92** is affected, and that the issue is fixed in **Appsmith ≥ 1.93**.
Jun 29, 2026
Several vendors and security trackers reported **high-impact vulnerabilities** with exploitation risk, alongside separate **social-engineering-driven breaches**. Zoom disclosed a **command injection** issue in Zoom Node Multimedia Routers (MMRs) used in certain hybrid meeting environments, tracked as **CVE-2026-22844** (reported with a high technical severity), which could allow meeting participants to execute arbitrary code; administrators were advised to update to *Zoom* version **5.2.1716.0**. SmarterTools reported a critical **authentication bypass** in *SmarterMail* (**CVE-2026-23760**) that could allow unauthenticated attackers to reset admin passwords via the `force-reset-password` API endpoint and potentially reach OS command execution and full remote code execution; mitigations included upgrading to **Build 9511**, resetting admin passwords, and enabling MFA. Separately, *Vite* was reported as affected by an **improper access control** flaw (**CVE-2025-31125**) enabling exposure of sensitive files by bypassing `server.fs.deny` protections using crafted query parameters (e.g., `?inline&import` or `?raw&import`); the issue was noted as being exploited in the wild and added to the **CISA Known Exploited Vulnerabilities** catalog. SC Media also reported active exploitation of an *Appsmith* **authentication flaw** (**CVE-2026-22794**) tied to the password reset flow, enabling account takeover by leaking reset tokens; defenders were urged to upgrade to **Appsmith 1.93**, which tightens Origin header validation and trusted base URL enforcement. In parallel to these vulnerability-driven risks, the Canadian Investment Regulatory Organization (**CIRO**) disclosed a **phishing-led breach** affecting ~**750,000** investors with exposure of highly sensitive identifiers (including social insurance numbers and investment information), while Betterment confirmed **unauthorized access via social engineering** that exposed customer contact/identity data and was used to send fraudulent cryptocurrency-scam notifications to users.
Jun 29, 2026
Internet-wide scanning identified **6,000+ SmarterTools SmarterMail** servers exposed online and likely vulnerable to **CVE-2026-23760**, a **critical authentication bypass** in the password reset API that enables **unauthenticated admin account takeover** and can lead to **remote code execution**. The flaw affects SmarterMail versions prior to **build 9511** and abuses the `/api/v1/auth/force-reset-password` (aka `force-reset-password`) endpoint, which allows anonymous password resets for administrator accounts without validating the existing password or requiring a reset token. SmarterTools issued a fix on **January 15, 2026** (later assigned CVE-2026-23760), and Shadowserver reported large-scale exposure with thousands of instances flagged as “likely vulnerable,” including heavy concentration in North America and additional exposure in Asia. Multiple sources reported **active exploitation** shortly after patch availability, with observed attacker behavior consistent with automated hijacking: resetting admin credentials, obtaining authenticated access, and then leveraging SmarterMail administrative capabilities to execute OS-level commands. Huntress reported attackers creating malicious **System Events** to run reconnaissance commands and establish persistence, while watchTowr (which reported the issue to SmarterTools) received additional reports of exploitation in production environments. The reporting also notes this disclosure follows closely after another critical pre-auth SmarterMail issue (**CVE-2025-52691**), reinforcing that unpatched, internet-exposed SmarterMail deployments are being actively targeted.
Jun 29, 2026