Summary
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- Vendor
- SmarterTools
- Product
- SmarterMail
- Added to KEV
- Jan 26, 2026
- Remediation due
- Feb 16, 2026 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-434
- EPSS
- 85.7% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References