Loading vulnerability…
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a small, focused Python proof-of-concept exploit for an unauthenticated SmarterTools SmarterMail authentication bypass identified as WT-2026-0001 and also referenced in one script as CVE-2026-23760. The repository structure is simple: top-level legal/disclaimer documentation, a detailed exploit-specific subdirectory (WT-2026-0001/) containing a README and the main exploit script, plus a second standalone PoC script at the repository root. The main exploit logic is in WT-2026-0001/exploit.py. It defines a SmarterMailExploit class with three core actions: (1) check_vulnerability(), which sends a POST request to /api/v1/auth/force-reset-password using a crafted JSON body and interprets a successful JSON response as vulnerable; (2) exploit(), which sends a similar POST request but with the operator-supplied replacement password to reset the admin password; and (3) verify_login(), which only prints instructions for manual login verification at /login.aspx. The script uses requests.Session(), disables TLS certificate verification, sets browser-like headers, and supports CLI arguments for target URL, username, replacement password, and a check-only mode. The exploit capability is straightforward and actionable: it resets an administrator password without prior authentication by abusing the force-reset-password API and setting IsSysAdmin to true while supplying an arbitrary OldPassword value. This yields administrative access to the SmarterMail web interface if the target is vulnerable. The exploit itself does not automate remote code execution, persistence, or lateral movement. However, the included documentation explicitly states that admin access can be followed by abuse of SmarterMail's Volume Mount functionality for command execution, making the password reset a stepping stone to full compromise. The secondary script, smartermail_poc.py, is a shorter standalone variant of the same attack. It performs a single POST request to the same endpoint with similar JSON fields and prints the response. It lacks the more structured vulnerability-check workflow of the main exploit but confirms the same core capability. Overall, this is a real exploit repository rather than a detector-only project. It is best classified as OPERATIONAL: it contains working exploit code and an attacker-controlled payload element (new password), but it is not part of a larger exploitation framework and does not include modular post-exploitation automation.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.