Flare Reports Rapid Exploit Sharing for SmarterMail Flaws
Summary
Flare researchers observed SmarterMail exploit code and administrator credentials shared within days of two vulnerability disclosures. The article reports 1,185 vulnerable servers and says CISA confirmed ransomware exploitation of CVE-2026-24423.
Key points
- Flare researchers reported seeing proof-of-concept exploits, offensive tools, and administrator credentials shared in underground Telegram channels and forums within days of the vulnerability disclosures.
- CVE-2026-24423 is described as an unauthenticated remote-code-execution flaw affecting SmarterMail versions before Build 9511, with a CVSS score of 9.3.
- CVE-2026-23760 is described as involving authentication-bypass and password-reset flaws that could enable privileged access; the article gives it a CVSS score of 9.3.
- Flare reported finding indications of SmarterMail on about 34,000 Shodan results, including 17,754 unique servers; it identified 1,185 as vulnerable to authentication-bypass or RCE flaws.
- The article says CISA added CVE-2026-24423 to its Known Exploited Vulnerabilities catalog in early February 2026 after confirming active ransomware exploitation.
- According to a SmarterTools report, attackers exploited an unpatched internal SmarterMail server in January 2026 and impacted about a dozen Windows servers; the company said core customer services and data were unaffected.
- Recommended defenses include urgent patching, monitoring administrator resets and unexpected mail-server activity, segmenting email infrastructure, and hunting for persistence or unexpected tools.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Authentication bypass
- Password reset logic flaws
- Severity
- Critical; CVSS 9.3 reported for both vulnerabilities
- Affected Versions
- SmarterMail versions prior to Build 9511
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Segment email infrastructure from internal networks and avoid unrestricted access.
- Monitor administrator password resets, API calls to external hosts, and unexpected outbound HTTP from mail servers.
- Hunt for API abuse and scheduled-task persistence.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe article identifies scheduled tasks as a persistence method in the described ransomware activity pattern.T1098 · Account ManipulationThe authentication-bypass and password-reset flaws enabled attackers to reset administrator credentials or gain privileged access.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in exposed SmarterMail servers to gain initial access.T1486 · Data Encrypted for ImpactRansomware operators triggered encryption payloads after gaining access through SmarterMail vulnerabilities.
CVE
CVE-2026-23760SmarterTools · SmarterMailwith threat actors sharing and selling exploit code and compromised access tied to CVE-2026-24423 and CVE-2026-23760, critical flaws that enable remote code execution and authentication bypass on exposed email servers.CVE-2026-24423SmarterTools · SmarterMailbeing disclosed, with threat actors sharing and selling exploit code and compromised access tied to CVE-2026-24423 and CVE-2026-23760, critical flaws that enable remote code execution and authentication bypass on