CVE-2026-23760

CVE-2026-23760 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 26, 2026, with confirmed use in ransomware campaigns. EIP tracks 2 public exploits from researchers including hilwa24, MaxMnMl. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a Python script that demonstrates an authentication bypass and remote code execution (RCE) exploit for SmarterMail via CVE-2026-23760. The exploit resets the admin password and executes arbitrary commands using the `AddOrUpdateMount` endpoint.

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.