SMTP Smuggling: New Flaw Lets Attackers Bypass Security and Spoof Emails

A new technique named SMTP smuggling abuses inconsistencies in how SMTP servers handle end-of-data sequences to inject additional SMTP commands and submit forged or multiple messages, enabling widespread email spoofing that can bypass DKIM, DMARC, and SPF protections; major vendors and MTAs (Microsoft, GMX, Cisco, Postfix, Sendmail) are affected to varying degrees, CERT/CC issued an advisory, some vendors have patched while certain default configurations (notably Cisco Secure Email) remain exploitable, and mitigations include vendor patches and configuration changes.