SmarterMail: Remote code execution via Volume Mount script
Summary
SmarterMail before Build 9777 contains a code injection flaw (CWE-94) that allows remote code execution. An attacker holding a SysAdmin-scoped access token can bypass the Volume Mount script-directory restriction, upload a malicious script and trigger it, resulting in a reverse shell as the SmarterMail service account with SYSTEM-level privileges. A valid SysAdmin token is required and no user interaction is needed.
Affected
- SmarterMail before Build 9777
- Unknown: whether builds between 9560 and 9777 are affected, as sources conflict.
Fixed in
- Build 9777 (released Oct 8, 2026) or later
Workaround
- Unknown. No vendor workaround is documented; the upgrade is the documented remediation.
Exploitation
- CISA SSVC: exploitation status PoC, not automatable.
- Public exploit material and a researcher write-up exist.
- Not listed in CISA KEV; no confirmed in-the-wild exploitation.
- EPSS 0.6% (as of 2026-10-13).
Our recommendation
- Upgrade to Build 9777 or later without delay.
- If the server is internet-facing and not yet patched, treat this as top priority.
- Restrict access to the admin interface to management networks.
- Review and revoke SysAdmin API tokens and check logs for unexpected domain or mount configuration changes.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
eev4n/smartermail
Research sources
- CNA/VulnCheck advisory www.vulncheck.com
- SmarterMail release notes (Build 9777) www.smartertools.com
- Researcher blog post blog.evan.lat
- VulDB entry vuldb.com
- GitHub repository eev4n/smartermail github.com
- ismalicious CVE details ismalicious.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:05.
Original description (NVD)
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.