“Enjoy Your Admin Access”: Critical SmarterMail RCE Exploited in the Wild

SecurityOnline[.]info reports that just weeks after a major SmarterMail vulnerability, researchers disclosed WT-2026-0001, an authentication bypass that lets unauthenticated attackers hijack administrative accounts and achieve full Remote Code Execution.

According to watchTowr Labs, the flaw resides in the force-reset-password API endpoint of the SmarterMail web interface, where the system fails to enforce basic security checks for admins, allowing a JSON request with IsSysAdmin set to true to overwrite credentials without validating the old password.

The attackers’ method requires no authentication or authorization, effectively providing “Enjoy your admin access” to the targeted account, with reports that threat actors are actively exploiting it to seize control of email servers. SmarterTools released Build 9511 on 15 January 2026 to address the issue, adding a validation step that checks the user’s old password before permitting a reset. Logs shared with researchers indicate exploitation occurred two days after the patch, underscoring the rapidity of the active threat.