CVE-2026-23760

What it actually does

SmarterMail builds prior to 9511 allow unauthenticated access to the password reset API endpoint used for forced password changes. The endpoint does not require a valid session, existing password, or reset token when the target is a system administrator account. An attacker who knows or guesses an administrator username can set a new password, authenticate as that administrator, and gain full SmarterMail administrative control. Because SmarterMail system administrator functionality can execute operating system commands, successful exploitation can escalate from application takeover to SYSTEM or root-level control of the underlying server.

Why it matters to the business

This is a critical, actively exploited authentication bypass with a very high likelihood of exploitation and known ransomware use. Compromise can lead to complete mail server takeover, mailbox access, credential theft, outbound phishing, data theft, service disruption, persistence, and direct operating system compromise. Organizations running exposed vulnerable SmarterMail instances should treat this as an emergency, especially because it is in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-02-16.

How an attack unfolds

An attacker first identifies an internet-facing SmarterMail server running a build earlier than 9511. They then send an unauthenticated request to the force-reset-password API, supplying the username of a system administrator and a password they control. Because the endpoint fails to validate authentication, the existing password, or a reset token, the password reset succeeds. The attacker logs in through the normal administrative interface using the newly set password, gains full SmarterMail system administrator access, and can modify mail settings, access data, create accounts, alter forwarding rules, or use built-in management functions to execute operating system commands. In ransomware scenarios, this access may be used to deploy payloads, disable services, steal mail data, pivot to other systems, or establish persistence before encryption or extortion activity.

How to fix it

Upgrade SmarterMail to build 9511 or later immediately. If immediate upgrade is not possible, remove public internet access to the SmarterMail administrative and password reset interfaces, restrict access to trusted VPN or management networks, and use web application firewall or reverse proxy rules to block unauthenticated access to the force-reset-password endpoint. After patching, rotate all SmarterMail system administrator passwords, invalidate active sessions, review and remove unauthorized administrator accounts, inspect mailbox forwarding and filtering rules, and review the host for command execution, persistence, and malware. Because exploitation can grant operating system-level access, treat vulnerable internet-facing systems as potentially compromised until investigated.

How to confirm the fix worked

Confirm the installed SmarterMail build is 9511 or later from the product administration interface, installer inventory, file metadata, or vendor-supported version reporting. Verify that unauthenticated requests to the force-reset-password endpoint are rejected and cannot change administrator credentials without proper authorization and reset validation. Confirm that administrative access is not publicly reachable except through approved controls such as VPN, identity-aware proxy, or restricted management networks. Review recent administrator password reset events and login history to ensure they correspond to approved activity. Run vulnerability scanning against externally exposed SmarterMail services and validate that scans no longer report this authentication bypass condition.

Typical attack path

1. Discover an exposed SmarterMail instance and determine that it is running a build prior to 9511.
2. Identify or guess a SmarterMail system administrator username.
3. Send an unauthenticated password reset request to the force-reset-password endpoint with the administrator username and attacker-controlled password.
4. Authenticate to the SmarterMail administrative interface using the reset credentials.
5. Create persistence such as additional administrator accounts, mailbox rules, forwarding rules, scheduled tasks, web-accessible files, or operating system users.
6. Use SmarterMail administrative capabilities to access mail data, change configuration, send phishing email, or execute operating system commands.
7. Deploy additional tooling, steal credentials and mailbox contents, move laterally, or conduct ransomware activity.

How to detect it

Review SmarterMail application logs, web server or reverse proxy access logs, authentication logs, administrator audit logs, Windows Event Logs or Linux auth logs, endpoint detection telemetry, and network flow records. Look for unauthenticated or unexpected HTTP requests containing force-reset-password, especially followed by successful administrator logins from the same source IP or an unfamiliar IP. Investigate any administrator password reset events that were not initiated through approved support or account recovery workflows. Hunt for new or modified administrator accounts, suspicious mailbox forwarding rules, changes to SMTP or relay settings, unusual outbound email spikes, and administrative configuration changes after the reset event. On the host, look for command execution spawned by the SmarterMail service process, new local users, scheduled tasks, services, startup items, web-accessible scripts, remote access tools, credential dumping tools, archive utilities used against mail stores, and ransomware staging behavior. Because the vulnerability is known to be exploited in ransomware campaigns, prioritize signs of data staging, mass file access, security tool tampering, shadow copy deletion, backup access, and encryption tooling.

• force-reset-password
• POST /force-reset-password
• GET /force-reset-password
• /force-reset-password
• password reset
• forced password reset
• administrator password reset
• system administrator password reset
• admin password reset
• Successful administrator login
• Administrator login successful
• New administrator account
• administrator account created
• mail forwarding rule created
• forwarding address added
• relay settings changed
• SMTP relay enabled
• SmarterMail
• w3wp.exe
• SmarterMail Service
• cmd.exe /c
• powershell.exe
• powershell -enc
• powershell -EncodedCommand
• vssadmin delete shadows
• wmic shadowcopy delete
• bcdedit /set {default} recoveryenabled no
• wevtutil cl
• cipher.exe /w
• rclone.exe
• 7z.exe
• rar.exe

What your security team should do

• Emergency-patch all SmarterMail instances to build 9511 or later, prioritizing internet-facing systems.
• Meet or beat the CISA KEV remediation deadline of 2026-02-16; because this is actively exploited and associated with ransomware activity, do not wait for normal patch cycles.
• Temporarily restrict SmarterMail administrative and password reset endpoints to trusted networks until patching and validation are complete.
• Assume compromise for any vulnerable internet-facing instance and perform incident response triage before simply returning the system to service.
• Reset all SmarterMail system administrator credentials and invalidate sessions after patching.
• Audit administrator accounts, mailbox forwarding rules, transport rules, API keys, service accounts, and configuration changes for unauthorized modifications.
• Collect and preserve web, application, authentication, and operating system logs before remediation where feasible.
• Hunt for requests to the force-reset-password endpoint, unexpected administrator password resets, successful admin logins following resets, and subsequent command execution from the SmarterMail service context.
• Check the underlying host for persistence, suspicious processes, newly created users, scheduled tasks, web shells, remote access tools, and ransomware precursors.
• Add SIEM detections for unauthenticated password reset attempts, admin password changes from unusual IP addresses, and administrative login immediately after a forced reset.