Huntress Catches SmarterMail Account Takeover Leading to RCE

Huntress observed active mass exploitation of a SmarterMail privileged account takeover vulnerability (CVE-2026-23760) that allows attackers to change privileged passwords and create malicious System Events to execute reconnaissance and commands leading to remote code execution; multiple automated HTTP POST requests and attacker IPs/user-agent indicators were recorded and SmarterMail released Build 9511 to address the issue.