“Enjoy Your Admin Access”: Critical SmarterMail RCE Exploited in the Wild

SmarterMail WT-2026-0001 is a critical authentication bypass in the force-reset-password API allowing unauthenticated attackers to overwrite administrator credentials; adversaries then leverage the product's Volume Mounts feature to execute arbitrary OS commands and achieve SYSTEM-level RCE. The report includes log evidence of exploitation occurring shortly after a vendor patch, and SmarterTools released Build 9511 to add validation of the old password.