CVE-2026-25067

Medium

Description

SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.

SeverityMedium

CVSS5.3

Exploit probability—

ProductSmartertools Smartermail

PublishedJan 29, 2026

First seenJan 29, 2026

Weakness typeCWE-706CWE-706

How to fix

Update

smartertools smartermail100.0.9518 or later

Patches

smartertools.com/smartermail/release-notes/current

Affected products

Product	Affected versions	Fixed in
smartertools smartermail	v < 100.0.9518	100.0.9518

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.