Critical SmarterMail vulnerability under attack, no CVE yet

A newly disclosed flaw in SmarterTools SmarterMail, tracked as WT-2026-0001, is under active attack just days after its patch, with no CVE assigned yet, according to the report. SmarterMail’s authentication bypass lets attackers reset the administrator password via a crafted request to the force-reset-password API endpoint, escalating to SYSTEM‑level access by abusing built‑in admin features to run arbitrary OS commands.

The vulnerability lies in SmarterMail’s unauthenticated ForceResetPassword path, which trusts an IsSysAdmin flag and accepts a deserialisable ForceResetPasswordInputs object including fields such as IsSysAdmin, Username, OldPassword, NewPassword and ConfirmPassword. The researchers note that the API endpoint accepts the OldPassword field but does not check it when resetting a system administrator’s password, effectively bypassing authentication.

The flaw was patched in version 9511 on 15 January 2026, but exploit attempts continue on unpatched systems, underscoring that upgrading is not optional, according to the report, with findings published by Watchtowr Labs. according to Watchtowr Labs.