CVE-2026-25067

SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion

Medium6.9EPSS 0.31%

Published: 29 Jan 2026
Updated: 5 Mar 2026
Reserved: 28 Jan 2026
Assigned by: VulnCheck

Description

SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.

Timeline

2026
28 Jan 2026
28 Jan 2026
ID reserved
By VulnCheck
29 Jan 20261 day later
29 Jan 2026· 1 day later
Published
5 Mar 202635 days later
5 Mar 2026· 35 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-25067, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.31% · top 76% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-706 Use of Incorrectly-Resolved Name or Reference (opens in a new tab)All about CWE-706 and its CVEs

Affected products

SmarterTools · SmarterMail
- affected < 100.0.9518

References (2)

https://www.smartertools.com/smartermail/release-notes/current (opens in a new tab)release-notespatch
https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-background-of-the-day-path-coercion (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-25067](https://trackcve.app/badge/CVE-2026-25067.svg)](https://trackcve.app/cve/CVE-2026-25067)

Record last updated 5 Mar 2026, 01:30 UTC.