CVE-2025-52691Vulnerability

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 26 Jan 2026.

Reported by 1 independent source · first reported 22 Jan 2026 by Huntress · last reported 22 Jan 2026

Last reported 9 months ago

CISA KEVAdded 26 Jan 2026
Fix due 16 Feb 2026
Used by ransomware: knownCISA KEV catalogue

EPSS85.7%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

1 report, newest first · the exact sentence from each

“Note that this is separate from the ongoing mass exploitation of CVE-2025-52691, an arbitrary file upload vulnerability in SmarterMail that also leads to remote code execution.”

HuntressVendor22 Jan 2026
Huntress Catches SmarterMail Account Takeover Leading to RCE

Indicators reported together

named in the same reports

142.111.152[.]57in 1 report
142.111.152[.]229in 1 report
155.2.215[.]66in 1 report
142.111.152[.]54in 1 report
142.111.152[.]53in 1 report
142.111.152[.]222in 1 report
142.111.152[.]159in 1 report
142.111.152[.]165in 1 report
155.2.215[.]70in 1 report
142.111.152[.]49in 1 report
155.2.215[.]74in 1 report
142.111.152[.]160in 1 report
155.2.215[.]73in 1 report
142.111.152[.]51in 1 report
155.2.215[.]60in 1 report
142.111.152[.]151in 1 report
142.111.152[.]46in 1 report
155.2.215[.]68in 1 report
142.111.152[.]155in 1 report

Copy these 19 indicators · defanged

19 indicators, defanged, one per line

142.111.152[.]57
142.111.152[.]229
155.2.215[.]66
142.111.152[.]54
142.111.152[.]53
142.111.152[.]222
142.111.152[.]159
142.111.152[.]165
155.2.215[.]70
142.111.152[.]49
155.2.215[.]74
142.111.152[.]160
155.2.215[.]73
142.111.152[.]51
155.2.215[.]60
142.111.152[.]151
142.111.152[.]46
155.2.215[.]68
142.111.152[.]155

Also named with it: CVE-2026-23760

Thanks — we review every report.

Report a wrong value