Skip to content
OpenAdvisories

Vendor

SmarterTools

15 known vulnerabilities.

SmarterTools at a glance

Last 12 months
11
Critical · all time
4
Exploited · all time
3
Public exploit · all time
4

3 of the exploited vulnerabilities are known to be used by ransomware (CISA).

New vulnerabilities per month · last 12 months
0 3 5 December 2025: 1 vulnerability, 1 critical Dec 2025 January 2026: 4 vulnerabilities, 2 critical February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 3 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202630
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202610
Apr 202610
Mar 202600
Feb 202610
Jan 202642
Dec 202511
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

SmarterMail 10 SmarterTrack 4 SmarterTools SmarterTrack 1

Latest advisories

  • Medium
    WID-SEC-2026-4384 0 CVEs

    SmarterTools SmarterMail: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

    Ein Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Auswirkungen zu verursachen.

    SmarterTools Linux
  • High max 8.8
    WID-SEC-2026-3869 3 CVEs

    SmarterTools SmarterMail: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um beliebigen Code mit SYSTEM-Rechten auszuführen, erhöhte Rechte auch weiterhin zu behalten, nachdem die Administratorrechte entzogen wurden, Cross-Site-Scripting-Angriffe zu st…

    SmarterTools Windows
  • Medium
    WID-SEC-2026-3734 0 CVEs

    SmarterTools SmarterMail: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

    Ein authentisierter Angreifer kann eine Schwachstelle in SmarterTools SmarterMail ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Zugriff auf ein Konto zu erlangen, dessen Identität er übernommen hat.

    SmarterTools Windows
  • Medium
    WID-SEC-2026-3464 0 CVEs

    SmarterTools SmarterMail: Schwachstelle ermöglicht nicht spezifizierten Angriff

    Ein Angreifer kann eine Schwachstelle in SmarterTools SmarterMail ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

    SmarterTools Windows
  • High
    WID-SEC-2026-3212 0 CVEs

    SmarterTools SmarterMail: Mehrere Schwachstellen

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um Pfadbeschränkungen zu umgehen und auf Dateien außerhalb vorgesehener Mailbox-Pfade zuzugreifen sowie möglicherweise administrative API-Funktionen, …

    SmarterTools Linux Windows
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • High 8.8
    CVE-2026-104084

    SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

    SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. At…

    SmarterTools SmarterMail
  • Medium 6.1
    CVE-2026-104083

    SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

    SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), whi…

    SmarterTools SmarterMail
  • High 7.2
    CVE-2026-104082 Public exploit

    SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

    SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary Fil…

    SmarterTools SmarterMail
  • High 8.1
    CVE-2026-7807

    SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API

    SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability …

    SmarterTools SmarterMail
  • Medium 5.9
    CVE-2026-40514

    SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

    SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the s…

    SmarterTools SmarterMail
  • High 7.2
    CVE-2026-26930

    SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.

    SmarterTools SmarterMail
  • Medium 6.9
    CVE-2026-25067

    SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion

    SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validat…

    SmarterTools SmarterMail
  • Critical 9.3
    CVE-2026-24423 Exploited · Ransomware Public exploit EPSS 88%

    SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. …

    SmarterTools SmarterMail
    KEV Feb 5, 2026
  • Critical 9.3
    CVE-2026-23760 Exploited · Ransomware Public exploit EPSS 96%

    SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

    SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resett…

    SmarterTools SmarterMail
    KEV Jan 26, 2026
  • High 7.5
    CVE-2020-36926

    SmarterTools SmarterTrack 7922 -Information Disclosure

    SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and las…

    SmarterTools SmarterTools SmarterTrack
  • Critical 10.0
    CVE-2025-52691 Exploited · Ransomware Public exploit EPSS 86%

    Upload Arbitrary Files

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

    SmarterTools SmarterMail
    KEV Jan 26, 2026
  • Critical 9.1
    CVE-2022-24387

    File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

    With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010

    SmarterTools SmarterTrack
  • High 8.8
    CVE-2022-24386

    Stored XSS in SmarterTrack v100.0.8019.14010

    Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

    SmarterTools SmarterTrack
  • Medium 6.5
    CVE-2022-24385

    Information disclosure via direct object access on SmarterTrack v100.0.8019.14010

    A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

    SmarterTools SmarterTrack
  • High 8.8
    CVE-2022-24384

    Reflective XSS on SmarterTrack v100.0.8019.14010

    Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

    SmarterTools SmarterTrack