CVE-2025-68624
Received Received - Intake

Authentication Bypass in N-able Mail Assure

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: MITRE

Description
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2025-68624
EUVD
EUVD-2025-210903

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n-able mail_assure From 2018-10 (inc) to 2025-03 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-68624 is a cross-tenant authorization flaw in N-able Mail Assure. An authenticated SMTP user can send outbound emails using sender addresses belonging to other tenants without authorization. The service verifies user credentials but fails to enforce domain-to-account binding, allowing impersonation of other tenant domains. Emails may pass SPF and DMARC validation, appearing legitimate.

Detection Guidance

Detecting this vulnerability requires checking SMTP logs for unauthorized cross-tenant email sending. Monitor for SMTP AUTH sessions where the MAIL FROM domain does not match the authenticated tenant. Use commands like 'grep' on SMTP logs to search for mismatched sender domains. Example: grep 'MAIL FROM:<*>' /var/log/mail.log | grep -v 'authenticated_tenant_domain'.

Impact Analysis

This vulnerability enables phishing, Business Email Compromise (BEC), and social engineering attacks. Attackers can impersonate legitimate domains, tricking recipients into disclosing sensitive information or transferring funds. Approximately 17,000 domains rely on Mail Assure, increasing the potential impact across multiple organizations.

Compliance Impact

The vulnerability undermines email authenticity and integrity, which are critical for compliance with GDPR, HIPAA, and other regulations requiring secure communication. Failure to prevent domain impersonation may result in non-compliance, data breaches, and legal penalties due to inadequate email security controls.

Mitigation Strategies

Immediately enforce sender-domain authorization by binding accounts to authorized domains. Configure the SMTP relay to reject cross-tenant sending attempts. Enable detailed logging of SMTP AUTH sessions and unauthorized cross-domain attempts. Review and update SPF, DKIM, and DMARC policies to detect anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart