Start with Identity
Subscribe
Identity CVE · Other

CVE-2026-23760SmarterMail auth bypass via an alternate path, CISA KEV

criticalCISA KEVActively exploited
Product: SmarterMailVendor: SmarterToolsDisclosed: 2026-01-15Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

SmarterMail enforced authentication on the obvious admin path and forgot another. CISA added the CVE to KEV in January 2026. Same class as Drupal Simple OAuth and OAuth2-Proxy.

Why it matters

Mail servers hold password-reset messages, MFA backup codes, and directory sync credentials. An auth bypass on SmarterMail is an identity incident, not a mail-admin inconvenience. The Zimbra KEV item (CVE-2025-66376) is the same lesson on a different product.

What to do

  • Patch SmarterMail to the January 2026 build that names this CVE.
  • Take the admin UI off the internet.
  • Hunt for new admin users and unexpected mailbox-forwarding rules.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.