CVE Watch4 ago 2026

CVE-2026-23760

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVSS

9.8

Crítico

EPSS

96.5%

p100

KEV

SÍ

26 ene 2026

Exploit Today

0-100

Publicado: 22 ene 2026 · Última mod.: 4 ago 2026 · CWE-288

EPSS · 30d

96.4%EPSS · 30 días96.5%

2026-09-172026-10-15

Ficha del catálogo KEV

Producto

SmarterTools / SmarterMail

Vulnerabilidad

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Añadido a KEV

26 ene 2026

Remediar antes de

16 feb 2026

Uso conocido en ransomware

Sí

Descripción resumida

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.smartertools.com/smartermail/release-notes/current ; https://nvd.nist.gov/vuln/detail/CVE-2026-23760

Descripción técnica

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-890576.8 MED

—

———A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.7h CVE-2026-19863—

44.2%

——13An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.17h CVE-2026-110852—

27.6%

——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.17h CVE-2026-890678.8 ALT

45.1%

——14Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.15h CVE-2026-858655.5 MED

19.9%

——6Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.2d CVE-2026-837875.5 MED

19.9%

——6Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.2d