Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

SmarterTools

Products: SmarterMail

121.7

Score

3

CVEs

3

Active

0

PoC

3

KEV

#17

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2026-24423	2026-01-23	9.3v4.0	ACTIVE		Low	None	YES	40.6	SmarterMail	SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vuln
CVE-2026-23760	2026-01-22	9.3v4.0	ACTIVE		Low	None	YES	40.6	SmarterMail	SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An una
CVE-2025-52691	2025-12-29	10.0v3.1	ACTIVE		Low	None	YES	40.6	SmarterMail	Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3