# CVE-2026-23760

> SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in man

- **CVSS:** 9.8 (CRITICAL)
- **EPSS:** 78.7%
- **CISA KEV:** yes (known ransomware use)
- **CWE:** CWE-288

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-23760
Full threat coverage + IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp