SmarterTools vulnerabilities

CVEs per yearBy the year they were published

1. 20224
2. 20251
3. 20268

Known exploitedNewest addition to KEV first

• CVE-2026-24423

  SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

  SmarterTools · SmarterMail

  ExploitedCritical9.3
• CVE-2026-23760

  SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

  SmarterTools · SmarterMail

  ExploitedCritical9.3
• CVE-2025-52691

  Upload Arbitrary Files

  SmarterTools · SmarterMail

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-104084

  SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

  Smartertools · Smartermail

  High8.7
• CVE-2026-104083

  SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

  Smartertools · Smartermail

  Medium5.3
• CVE-2026-104082

  SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

  Smartertools · Smartermail

  High8.6
• CVE-2026-26930

  SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.

  SmarterTools · SmarterMail

  High7.2
• CVE-2026-25067

  SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion

  SmarterTools · SmarterMail

  Medium6.9
• CVE-2026-24423

  SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

  SmarterTools · SmarterMail

  ExploitedCritical9.3
• CVE-2026-23760

  SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

  SmarterTools · SmarterMail

  ExploitedCritical9.3
• CVE-2020-36926

  SmarterTools SmarterTrack 7922 -Information Disclosure

  Smartertools · SmarterTools SmarterTrack

  Medium6.9
• CVE-2025-52691

  Upload Arbitrary Files

  SmarterTools · SmarterMail

  ExploitedCritical10.0
• CVE-2022-24387

  File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010

  SmarterTools · SmarterTrack

  Critical9.1