CVE-2025-52691

CRITICALCVSS 10.0Known Exploited

CISA Known Exploited Vulnerability

https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691

Remediation deadline: February 16, 2026

Ransomware use: Known

Description

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Timeline

Published:December 29th, 2025 3:15 AM

Last modified:October 7th, 2026 12:10 PM

Added to KEV:January 26th, 2026

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

smartertools

Products

smartermail

Weaknesses (CWE)

CWE-434

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute