CVE-2026-23760

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

CRITICAL

9.8

CVSS Score

Published: January 22, 2026 at 02:35 PM UTC

Updated: August 4, 2026 at 05:35 AM UTC

1 product affected across 1 vendorSmarterMail

Using SmarterMail by SmarterTools?

Get instant alerts when new vulnerabilities affect SmarterMail - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploitation

CISA KEV

Exploit prediction

EPSS 96%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score96.4%

EPSS (Exploit Prediction Scoring System) estimates a 96.4% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Known

Added to KEV

Jan 26, 2026

Remediation Due

Feb 16, 2026

259 days overdue

Notes

https://www.smartertools.com/smartermail/release-notes/current

https://nvd.nist.gov/vuln/detail/CVE-2026-23760

Description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.