CVE-2026-23760 SmarterTools SmarterMail
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow…
- CVSS
- not scored
On CISA’s exploited list
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Added
- 2026-01-26
- Federal patch deadline
- 2026-02-16
- Ransomware use
- known