CVE-2026-23760Vulnerability

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 26 Jan 2026.

Reported by 1 independent source · first reported 22 Jan 2026 by Huntress · last reported 22 Jan 2026

Last reported 9 months ago

CISA KEVAdded 26 Jan 2026
Fix due 16 Feb 2026
Used by ransomware: knownCISA KEV catalogue

EPSS96.4%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

1 report, newest first · the exact sentence from each

“…Detection Engineering and Threat Hunting) Team has observed in-the-wild exploitation of a privileged account takeover vulnerability (CVE-2026-23760) in SmarterTool’s SmarterMail application that has resulted in successful remote code execution.”

HuntressVendor22 Jan 2026
Huntress Catches SmarterMail Account Takeover Leading to RCE

Indicators reported together

named in the same reports

142.111.152[.]57in 1 report
142.111.152[.]229in 1 report
155.2.215[.]66in 1 report
142.111.152[.]54in 1 report
142.111.152[.]53in 1 report
142.111.152[.]222in 1 report
142.111.152[.]159in 1 report
142.111.152[.]165in 1 report
155.2.215[.]70in 1 report
142.111.152[.]49in 1 report
155.2.215[.]74in 1 report
142.111.152[.]160in 1 report
155.2.215[.]73in 1 report
142.111.152[.]51in 1 report
155.2.215[.]60in 1 report
142.111.152[.]151in 1 report
142.111.152[.]46in 1 report
155.2.215[.]68in 1 report
142.111.152[.]155in 1 report

Copy these 19 indicators · defanged

19 indicators, defanged, one per line

142.111.152[.]57
142.111.152[.]229
155.2.215[.]66
142.111.152[.]54
142.111.152[.]53
142.111.152[.]222
142.111.152[.]159
142.111.152[.]165
155.2.215[.]70
142.111.152[.]49
155.2.215[.]74
142.111.152[.]160
155.2.215[.]73
142.111.152[.]51
155.2.215[.]60
142.111.152[.]151
142.111.152[.]46
155.2.215[.]68
142.111.152[.]155

Also named with it: CVE-2025-52691

Thanks — we review every report.

Report a wrong value