https://pwn.watch/t/smartermail Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 05 Feb 2026 00:00:00 GMT https://pwn.watch/i/smartertools-smartermail-cve-2026-24423 https://pwn.watch/i/smartertools-smartermail-cve-2026-24423 Thu, 05 Feb 2026 00:00:00 GMT high <p>SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-02-05: CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).</li></ul> <p><strong>CVEs:</strong> CVE-2026-24423</p> https://pwn.watch/i/smartertools-smartermail-cve-2025-52691 https://pwn.watch/i/smartertools-smartermail-cve-2025-52691 Mon, 26 Jan 2026 00:00:00 GMT high <p>SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691, CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26 based on evidence of active exploitation.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-01-26: CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16).</li></ul> <p><strong>CVEs:</strong> CVE-2025-52691, CVE-2026-23760</p>