CVE-2026-23760SmarterMail auth bypass via an alternate path, CISA KEV

What broke

SmarterMail enforced authentication on the obvious admin path and forgot another. CISA added the CVE to KEV in January 2026. Same class as Drupal Simple OAuth and OAuth2-Proxy.

Why it matters

Mail servers hold password-reset messages, MFA backup codes, and directory sync credentials. An auth bypass on SmarterMail is an identity incident, not a mail-admin inconvenience. The Zimbra KEV item (CVE-2025-66376) is the same lesson on a different product.

What to do

• Patch SmarterMail to the January 2026 build that names this CVE.
• Take the admin UI off the internet.
• Hunt for new admin users and unexpected mailbox-forwarding rules.

After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

• Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
• Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
• Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
• Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
• Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.

Sources

• NVD: CVE-2026-23760
• CISA KEV, January 2026