SmarterMail Account-Takeover Flaw Exploited to Achieve Remote Code Execution
Summary
Huntress observed in-the-wild exploitation of CVE-2026-23760 in SmarterMail, enabling privileged account takeover and remote code execution. Versions before Build 9511 are affected; Huntress recommends upgrading.
Key points
- Huntress reported active exploitation of CVE-2026-23760 across multiple customers, with requests made in quick succession that suggest automated activity.
- The flaw allowed an attacker to change a privileged user’s password without authentication because the password-reset endpoint did not validate the old password.
- Attackers used compromised privileged access to create malicious System Events and run reconnaissance commands when a new domain was added.
- Huntress observed requests to reset passwords, authenticate, configure System Events, and add and delete a domain; one observed domain was google[.]abc[.]com.
- SmarterMail versions before Build 9511 are vulnerable. The build, released January 15, 2026, contains the fix.
- Huntress says this is separate from ongoing exploitation of CVE-2025-52691, another SmarterMail vulnerability that can lead to remote code execution.
- Huntress recommends upgrading to the latest SmarterMail version and checking outdated systems for signs of compromise.
Article Details
- Vulnerability Types
- Privileged account takeover through an unauthenticated password reset
- Arbitrary file upload
- Affected Versions
- SmarterMail versions prior to Build 9511
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 142[.]111[.]152[.]150 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]151 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]154 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]155 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]159 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]160 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]165 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]222 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]229 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]45 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]46 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]47 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]49 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]51 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]53 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]54 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]56 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]57 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 142[.]111[.]152[.]59 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]60 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]62 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]66 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]67 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]68 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]70 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]72 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]73 | Source IP observed in attacks against SmarterMail customers. |
| IPV4 | 155[.]2[.]215[.]74 | Source IP observed in attacks against SmarterMail customers. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe attacker configured malicious System Events to execute reconnaissance commands on vulnerable hosts.T1078 · Valid AccountsAfter taking over a privileged account, the attacker used its credentials to obtain a valid access token.T1190 · Exploit Public-Facing ApplicationThe attacker exploited a vulnerability in the SmarterMail application through its HTTP API.
CVE
CVE-2025-52691SmarterTools · SmarterMailNote that this is separate from the ongoing mass exploitation of CVE-2025-52691, an arbitrary file upload vulnerability in SmarterMail that also leads to remote code execution.CVE-2026-23760SmarterTools · SmarterMailHunting) Team has observed in-the-wild exploitation of a privileged account takeover vulnerability (CVE-2026-23760) in SmarterTool’s SmarterMail application that has resulted in successful remote code execution.