CRITICAL CISA KEV Actively Exploited

CVE-2026-23760

Q: What is CVE-2026-23760?

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail sys

Q: Is CVE-2026-23760 actively exploited?

Yes. CVE-2026-23760 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2026-02-16.

Q: What is the CVSS score for CVE-2026-23760?

CVE-2026-23760 has a CVSS v3 base score of 9.8 (CRITICAL severity).

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

CVSS v3

9.8

CRITICAL

EPSS Score

96.5 %

exploit probability, as of 2026-10-04

CISA KEV

Yes

known exploited

Exploitation

active

SSVC status

Description

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail sys

CISA Known Exploited Vulnerability

Date Added: 2026-01-26
Patch Due Date: 2026-02-16
Ransomware Use: Unknown

Technical details

Published: 2026-01-22
Last Modified: 2026-01-27

Frequently asked questions

What is CVE-2026-23760?

Is CVE-2026-23760 actively exploited?

Yes. CVE-2026-23760 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2026-02-16.

What is the CVSS score for CVE-2026-23760?

CVE-2026-23760 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2026-23760 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Go further

For a threat intelligence platform: malware, C2 and ransomware indicators over STIX/TAXII.

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database