CVE-2025-68624: Medium severity N-able Mail Assure vulnerability
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this behavior?
Any user with valid SMTP AUTH credentials for any Mail Assure tenant can submit outbound mail using MAIL FROM addresses associated with other tenants. No victim-tenant credentials are required.
What access and conditions are required?
The attacker needs network access to the SMTP TCP port and valid SMTP authentication credentials. The described behavior does not require user interaction or a complex exploit.
What is the likely impact of successful misuse?
An attacker can impersonate another tenant's sender domain in outbound email. The resulting messages can pass SPF and DMARC validation, increasing the credibility of spoofed mail.
Is this considered a configuration error that can be corrected by enabling a setting?
The available information describes a design-level authorization issue in the shared SMTP relay architecture. N-able states that arbitrary sender-domain use is intended functionality and does not represent that the service enforces per-tenant sender-domain binding.
How can an organization determine whether it is exposed?
The described affected scope is Mail Assure through April 2026. Organizations can assess exposure by determining whether their Mail Assure SMTP-authenticated users can submit test messages with MAIL FROM addresses outside their own tenant domains.