A critical authentication bypass vulnerability in SmarterTools SmarterMail is currently being actively exploited in the wild to achieve full administrative compromise of affected email servers.

This flaw exists within the force-reset-password API endpoint, which allows unauthenticated users to initiate a password reset for any account, including system administrators. By manipulating the IsSysAdmin parameter, an attacker can bypass all authentication checks and gain unauthorized administrative access, which further permits the execution of operating system commands.

The exploitation of this vulnerability results in a total compromise of the SmarterMail instance. Given that system administrator privileges in SmarterMail provide the ability to execute operating system commands, an attacker can move laterally within the network, exfiltrate sensitive email data, or deploy persistent backdoors. With a CVSS score of 9.5, this vulnerability represents a critical risk to organizational data integrity and confidentiality.

Immediate Action: Update SmarterMail to build 100.0.9511 or later immediately to patch the password reset API.

Proactive Monitoring: Review audit logs for suspicious activity related to the force-reset-password endpoint and monitor for unauthorized administrative account creation or unexpected operating system process execution originating from the SmarterMail service account.

Compensating Controls: Implement strict network access controls to restrict access to the SmarterMail web interface to trusted IP addresses only, and deploy a Web Application Firewall (WAF) to block requests targeting the force-reset-password API endpoint until the update is applied.

Public Exploit Available: Yes, public Proof-of-Concepts are available on GitHub and referenced in security research writeups.

Due to the critical severity of this vulnerability, its inclusion in the CISA KEV catalog, and confirmed active exploitation, organizations must prioritize patching SmarterMail to build 100.0.9511. Any delay in applying this update significantly increases the risk of a full system compromise. If patching is not immediately feasible, the affected services should be isolated from the public internet until remediation can be verified.