CVE-2025-52691

SmarterTools SmarterMail

Published 29 Dec 2025 · updated 17 Jun 2026 · Analyzed

10.0 Critical · CVSS 3.1, CNA

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 26 Jan 2026, with a remediation deadline of 16 Feb 2026 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ · Third Party Advisory
github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691 · US Government Resource