Huntress Catches SmarterMail Account Takeover Leading to RCE

What it is

Huntress DE&TH Team's writeup of in-the-wild exploitation of CVE-2026-23760, a privileged account takeover vulnerability in SmarterTools' SmarterMail. Chained with access to SmarterMail's System Events feature, it yields remote code execution. Builds prior to 9511 are vulnerable; 9511 was released January 15, 2026. This is distinct from CVE-2025-52691, an arbitrary file upload RCE in SmarterMail also under mass exploitation.

How it works

The root cause: the /api/v1/auth/force-reset-password endpoint did not validate whether the submitted old password was correct. This lets an attacker change a privileged user's password without authentication. Huntress confirmed this by diffing binary builds 9504 (Jan 8) and 9511 (Jan 15) and by building a working exploit.

Once the privileged account is hijacked, the attacker uses SmarterMail's System Events functionality to create malicious events that execute commands on the host — initially reconnaissance. Application logs show a series of HTTP POST requests in a fixed order (detailed in the page's Table 1, not reproduced in the fetched text). The same requests hitting multiple customers in quick succession indicate mass automated exploitation.

flowchart LR
    A[Unauth POST to force-reset-password] -->|old password not checked| B[Privileged account taken over]
    B --> C[Create malicious System Event]
    C --> D[Command execution / recon on host]
    E[Upgrade to Build 9511] -.cuts.-> A

Preconditions / Affected

• SmarterMail builds prior to 9511.
• Reachable webmail/API surface — the takeover request needs no valid credentials.

What to do

• Upgrade to SmarterMail Build 9511 (released Jan 15, 2026).
• Given active exploitation of both CVE-2026-23760 and CVE-2025-52691, review outdated/exposed systems for signs of compromise. The page flags /api/v1/auth/force-reset-password POSTs and unexpected System Events as the relevant artifacts.

Caveats

• The fetched text references Table 1 (exact request sequence) and Figure 1 (the binary diff) but does not reproduce their contents, so specific detection strings/IOCs are not in this excerpt.
• CVE-2026-23760 was concurrently disclosed by WatchTowr; Huntress notes it observed a different RCE method in the wild than the one being disclosed, so exploitation techniques may vary.