Actively exploited vulnerabilities affecting SmarterTools products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-24423https://wildfortech.com/security#CVE-2026-24423SmarterMail's ConnectToHub API method lacks authentication, meaning an unauthenticated attacker can redirect the mail server to a malicious HTTP server of their choosing and execute arbitrary OS commands on the underlying system. This is a critical server-side vulnerability with no user interaction required. It has already been linked to active ransomware campaigns, making exposed SmarterMail instances at immediate risk of full system compromise and data encryption.Thu, 05 Feb 2026 00:00:00 GMTSmarterToolsSmarterMailhttps://wildfortech.com/security#CVE-2025-52691https://wildfortech.com/security#CVE-2025-52691SmarterMail contains a critical flaw allowing unauthenticated attackers to upload arbitrary files anywhere on the mail server. Because no authentication is required and files can land in any location, attackers can place executable content that runs with server privileges — achieving full remote code execution. This vulnerability is already being actively exploited in ransomware campaigns, making exposed mail servers an immediate, high-priority target with potential for complete system compromise.Mon, 26 Jan 2026 00:00:00 GMTSmarterToolsSmarterMailhttps://wildfortech.com/security#CVE-2026-23760https://wildfortech.com/security#CVE-2026-23760SmarterMail's password reset API has a critical flaw: the endpoint that forces a password reset on administrator accounts accepts anonymous requests and doesn't verify the existing password or a valid reset token. An attacker who knows only an admin username can remotely set a new password and take full control of the mail server. This vulnerability is already being exploited in ransomware attacks, making it an urgent threat to any organization running SmarterMail.Mon, 26 Jan 2026 00:00:00 GMTSmarterToolsSmarterMail