CVE WatchAug 4, 2026

CVE-2026-23760

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVSS

9.8

Critical

EPSS

96.5%

p100

KEV

YES

Jan 26, 2026

Exploit Today

0-100

Published: Jan 22, 2026 · Last modified: Aug 4, 2026 · CWE-288

EPSS · 30d

96.4%EPSS · 30 days96.5%

2026-09-162026-10-14

KEV catalog record

Product

SmarterTools / SmarterMail

Vulnerability

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Added to KEV

Jan 26, 2026

Remediate by

Feb 16, 2026

Known ransomware use

Yes

Summary description

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.smartertools.com/smartermail/release-notes/current ; https://nvd.nist.gov/vuln/detail/CVE-2026-23760

Technical description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-110852—

—

——0n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.12h CVE-2026-890678.8 HIG

—

——0Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.7h CVE-2026-858655.5 MED

19.8%

——6Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.2d CVE-2026-837875.5 MED

19.8%

——6Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.18h CVE-2026-11013010.0 CRI

45.2%

——14Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.18h CVE-2026-117318.8 HIG

15.7%

——5An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.1d