Over 6,000 SmarterMail servers exposed to automated hijacking attacks
Recorded: Jan. 27, 2026, 4 p.m.
| Original | Summarized |
Over 6,000 SmarterMail servers exposed to automated hijacking attacks News Featured New ClickFix attacks abuse Windows App-V scripts to push malware Microsoft patches actively exploited Office zero-day vulnerability Nearly 800,000 Telnet servers exposed to remote attacks Cloudflare misconfiguration behind recent BGP route leak OpenAI's ChatGPT ad costs are on par with live NFL broadcasts Fortinet blocks exploited FortiCloud SSO zero day until patch is ready Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor WinRAR path traversal flaw still exploited by numerous hackers Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityOver 6,000 SmarterMail servers exposed to automated hijacking attacks Over 6,000 SmarterMail servers exposed to automated hijacking attacks By Sergiu Gatlan January 27, 2026 Nonprofit security organization Shadowserver has found over 6,000 SmarterMail servers exposed online and likely vulnerable to attacks exploiting a critical authentication bypass vulnerability. "SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API," according to an advisory added to the NIST national vulnerability database on Thursday. Internet-exposed SmarterMail servers (Shadowserver) 7 Security Best Practices for MCP Related Articles: Actively Exploited Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft patches actively exploited Office zero-day vulnerability Microsoft investigates Windows 11 boot failures after January updates Microsoft releases emergency OOB update to fix Outlook freezes Sponsor Posts Discover how phishing kits are sold and deployed. Download the full research report. Get a free shadow AI inventory today Overdue a password health-check? Audit your Active Directory for free Is your data already on a leak site? Monitor your exposure threats for free. Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Over 6,000 SmarterMail servers were discovered to be exposed online and vulnerable to automated hijacking attacks, according to a report by Shadowserver. The vulnerability centers around an authentication bypass flaw within SmarterMail versions prior to build 9511, specifically in the password reset API endpoint. This allows unauthenticated attackers to supply a target administrator username and a new password, resulting in full administrative compromise of the SmarterMail instance. The discovery follows a prior report by watchTowr identifying a related critical pre-auth vulnerability (CVE-2025-52691), and subsequent confirmation of exploitation by cybersecurity firms such as Huntress and CISA. The vulnerability, designated CVE-2026-23760, was initially reported by watchTowr on January 8th, and a fix was released by SmarterTools on January 15th without an identifier. However, the flaw quickly became active, with Shadowserver tracking over 6,000 vulnerable SmarterMail servers globally – approximately 4,200 across North America and nearly 1,000 in Asia. A proof-of-concept exploit, requiring only prior knowledge of the administrator’s username, was shared by watchTowr, confirming ongoing, automated exploitation. The situation escalated with CISA adding the vulnerability to its list of actively exploited vulnerabilities on Monday, February 16th, issuing a directive to U.S. government agencies to secure their servers within three weeks. This aligns with previously identified issues, including a near 800,000 IP address cluster associated with Telnet exploitation. The vulnerability’s impact is significant, representing a frequent attack vector for malicious cyber actors and posing substantial risks to the federal enterprise. Mitigation strategies include applying vendor-supplied patches, implementing guidance from the Business Objectives Directive (BOD) 22-01 for cloud services, or discontinuing use of the product if appropriate mitigations are unavailable. The rapid spread of this vulnerability underscores the importance of proactive vulnerability management and timely patching procedures. The initial discovery was compounded by the ongoing exploitation of a similar authentication bypass flaw in the GNU Inetutils telnetd server, resulting in the identification of a massive IP address cluster indicative of continued attacks. This confirms a pattern of attackers leveraging known vulnerabilities to gain unauthorized access to critical systems. The series of related exploits highlights the need for constant vigilance and robust security protocols, particularly within organizations reliant on legacy systems or those lacking adequate patching infrastructure. |