CVE-2025-52691 (CVSS 10): Critical SmarterMail Flaw Opens Servers to Unauthenticated Attacks

CVE-2025-52691 (CVSS 10) is a critical SmarterMail flaw that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution, according to the advisory. The vulnerability lies in how the software handles file uploads, and any internet-exposed server is an immediate target since no authentication is required. It affects SmarterMail versions Build 9406 and earlier, with administrators urged to patch to SmarterMail Build 9413 immediately.

The discovery was credited to Singapore’s cyber defenders, with Mr. Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT) identified as the individual who flagged the vulnerability, according to CSA Singapore. SmarterTools has released a patch, and the CSA urged swift action to mitigate the risk.