ZDI-26-997: SmarterTools SmarterMail Insufficient Entropy Authentication Bypass Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to bypass authentication on affected installations of SmarterTools SmarterMail. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.1. The following CVEs are assigned: CVE-2026-126969.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

No authentication is required. A remote attacker can exploit the vulnerability without valid SmarterMail credentials.

How severe is this vulnerability?

ZDI assigned a CVSS rating of 9.1, indicating a critical-severity issue.

ZDI-26-997: SmarterTools SmarterMail Insufficient Entropy Authentication Bypass Vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How severe is this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How severe is this vulnerability?