CVE-2026-23760 is an unauthenticated password-reset API flaw in SmarterTools SmarterMail that lets an attacker reset any system administrator's password without a token or prior credential, and because SmarterMail admins can run OS commands through built-in management tools, this hands the attacker SYSTEM/root access on the mail server; NVD rates it 9.8 Primary and CISA KEV records known ransomware use.
Vulnerability summary
9.8
Critical
96.4%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-01-22
Published
Vulnerability ID: CVE-2026-23760 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SmarterTools SmarterMail | cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* | < build 100.0.9511 (fixed in build 9511) |
What this means
CVE-2026-23760 is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in SmarterTools SmarterMail, an on-premises email and collaboration server. NVD's description states that builds before 9511 "contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts," so "an unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance." NVD further notes that "SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host" (NVD).
NVD has completed its own analysis and published a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a CNA-submitted CVSS v4.0 score of 9.3 is also on record from the disclosing researchers at VulnCheck (NVD).
The bug was publicly documented by watchTowr Labs and CODE WHITE GmbH, crediting researchers Piotr Bazydlo and Sina Kheirkhah (watchTowr) and Markus Wulftange (CODE WHITE), who reverse-engineered the force-reset-password endpoint and showed the path from unauthenticated password reset to full remote code execution via SmarterMail's administrative command features (VulnCheck Advisory).
CISA added CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26, with a required-action due date of 2026-02-16, and records known ransomware campaign use for this CVE — one of the stronger severity signals in the KEV catalog (CISA KEV).
FIRST EPSS currently scores the probability of exploitation at 0.9643 (99.88th percentile) as of 2026-10-30, among the highest EPSS scores of any CVE in this dataset, consistent with an unauthenticated admin-takeover bug with public proof-of-concept and documented ransomware use (FIRST EPSS).
Any SmarterMail instance below build 9511 should be upgraded immediately; because an unauthenticated attacker only needs network access to the password-reset endpoint, exposed on-premises SmarterMail servers should also be checked for signs of prior administrator-account compromise.
Evidence
- The force-reset-password API endpoint in SmarterMail builds before 9511 accepts anonymous requests and does not verify the existing password or a reset token, letting an unauthenticated attacker reset any administrator account; admin privileges allow OS command execution, giving SYSTEM/root access. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a CNA (VulnCheck) CVSS v4.0 score of 9.3 is also on record. — NVD
- Disclosed and technically documented by watchTowr Labs and CODE WHITE GmbH, crediting Piotr Bazydlo, Sina Kheirkhah and Markus Wulftange, showing the path from password reset to full admin/RCE. — VulnCheck Advisory
- Added to the CISA KEV catalog on 2026-01-26, due date 2026-02-16, with known ransomware campaign use recorded. — CISA KEV
- EPSS score is 0.9643 (99.88th percentile) as of 2026-10-30. — FIRST EPSS
