# CVE-2026-23760: SmarterMail - Authentication Bypass

> Live exploitation tracking for CVE-2026-23760 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-23760

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** SmarterTools SmarterMail
- **Weaknesses:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
- **Tags:** mail

## Description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

## CrowdSec analysis

[CVE-2026-23760](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-23760) is a critical authentication bypass vulnerability in SmarterTools SmarterMail versions prior to build 9511, specifically affecting the password reset API. This flaw allows unauthenticated attackers to reset administrator account passwords without any verification, leading to full administrative compromise of the SmarterMail instance. Exploiting this vulnerability could grant attackers SYSTEM or root-level access to the underlying host, enabling them to execute arbitrary operating system commands and potentially take complete control of the server.

CrowdSec has been tracking this vulnerability and its exploits since 2nd of February 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2026-23760 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2026-23760 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/api/v1/auth/force-reset-password` endpoint by sending crafted POST requests to reset the admin password, potentially gaining unauthorized administrative access.

## Timeline

- 2026-01-22: CVE Published. CVE-2026-23760 is published to NVD.
- 2026-01-26: CISA KEV. CVE-2026-23760 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-02-02: Rule Released. CrowdSec releases a rule to detect CVE-2026-23760 exploitation attempts against the CrowdSec Network.
- 2026-02-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-23760 for the first time.
- 2026-02-16: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce
- https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/
- https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail
- https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760
- https://www.smartertools.com/smartermail/release-notes/current
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23760.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-23760) follows observed exploitation activity for CVE-2026-23760. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.