SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release

Two days after SmarterTools released Build 9511 on 15 January 2026, the SmarterMail authentication bypass began being exploited in the wild, according to watchTowr Labs, which tracks the flaw as WT-2026-0001. The vulnerability is an authentication bypass that could allow any user to reset a SmarterMail system administrator password via a crafted HTTP request to the /api/v1/auth/force-reset-password endpoint, with the attacker able to obtain a SYSTEM-level shell through a remote code execution path.

The flaw stems from SmarterMail.Web.Api.AuthenticationController[.]ForceResetPassword, which can be reached without authentication and uses a boolean flag named IsSysAdmin to determine whether the request targets an administrator account. Researchers Piotr Bazydlo and Sina Kheirkhah described that if IsSysAdmin is true, the process can locate the specified username, create a new administrator item with a chosen password, and update the account accordingly.

The story cites a user on the SmarterTools Community Portal who claimed they lost access to their admin account on 17 January 2026, two days after the patch, suggesting the patch was reverse engineered by attackers. SmarterTools’ CEO Tim Uzzanti indicated plans to email customers about new CVEs and builds, while the release notes for Build 9511 listed only “IMPORTANT: Critical security fixes.”