SmarterMail - Authentication Bypass (CVE-2026-23760)

CVE-2026-23760 is a critical authentication bypass vulnerability in SmarterTools SmarterMail versions prior to build 9511, specifically affecting the password reset API. This flaw allows unauthenticated attackers to reset administrator account passwords without any verification, leading to full administrative compromise of the SmarterMail instance. Exploiting this vulnerability could grant attackers SYSTEM or root-level access to the underlying host, enabling them to execute arbitrary operating system commands and potentially take complete control of the server.

CrowdSec has been tracking this vulnerability and its exploits since 2nd of February 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2026-23760 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2026-23760 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /api/v1/auth/force-reset-password endpoint by sending crafted POST requests to reset the admin password, potentially gaining unauthorized administrative access.