CVE Watch—

CVE-2025-52691

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVSS

—

Sin CVSS

EPSS

85.5%

p100

KEV

SÍ

26 ene 2026

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

85.5%EPSS · 30 días85.5%

2026-06-302026-07-16

Ficha del catálogo KEV

Producto

SmarterTools / SmarterMail

Vulnerabilidad

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Añadido a KEV

26 ene 2026

Remediar antes de

16 feb 2026

Uso conocido en ransomware

Sí

Descripción resumida

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-23760—

99.9%

KEV—80SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability—CVE-2026-24423—

99.7%

KEV—80SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability—