SmarterTools vulnerabilities
15 CVEs and advisories name SmarterTools as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-104084SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
- CVE-2026-104083SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
- CVE-2026-104082SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
- CVE-2026-7807SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API
- CVE-2026-40514SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG
- CVE-2026-26930SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.
- CVE-2026-25067SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion
- CVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
- CVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
- CVE-2020-36926SmarterTools SmarterTrack 7922 -Information Disclosure
- CVE-2025-52691Upload Arbitrary Files
- CVE-2022-24387File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
- CVE-2022-24386Stored XSS in SmarterTrack v100.0.8019.14010
- CVE-2022-24385Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
- CVE-2022-24384Reflective XSS on SmarterTrack v100.0.8019.14010