Known Exploited Vulnerabilities January 26, 2026 · CISA KEV Catalog

CVE-2026-23760: Smarter Tools Smarter Mail Authentication Bypass Using an Alternate Path or Channel Vulnerability

SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2026-23760SmarterTools

Related

CVE-2026-24423: Smarter Tools Smarter Mail Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Feb 05, 2026

CVE-2025-52691: Smarter Tools Smarter Mail Unrestricted Upload of File with Dangerous Type Vulnerability Known Exploited Vulnerabilities · Jan 26, 2026

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026