CVE-2026-104082
Received Received - Intake

Remote Code Execution in SmarterMail

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-104082
EUVD
EUVD-2026-95887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Smartertools Smartermail 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SmarterMail before build 9777 allows attackers with SysAdmin access to execute arbitrary code remotely. The flaw involves bypassing script-directory containment controls by setting a malicious FileStore root path within the Scripts directory. Attackers can then upload a malicious script through the mail file-storage API, which executes via RunScript before validation, granting SYSTEM-level privileges through a reverse shell running as the SmarterMail service account.

Detection Guidance

To detect this vulnerability, check if your SmarterMail version is before build 9777. Review system logs for suspicious activity in the Scripts directory or unusual API calls to domain-put, AddOrUpdateMount, or global-mail endpoints. Monitor for unauthorized script uploads or unexpected SYSTEM-level processes running as the SmarterMail service account.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain full control over the SmarterMail server, execute arbitrary commands, and access sensitive data. The impact includes potential data breaches, unauthorized system access, and disruption of mail services. The attack requires SysAdmin access, but successful exploitation grants SYSTEM-level privileges.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access, potential data breaches, and lack of proper access controls. Organizations using vulnerable SmarterMail versions may face legal penalties, reputational damage, and loss of customer trust.

Mitigation Strategies
  • Upgrade SmarterMail to build 9777 or later to address the vulnerability.
  • Restrict SysAdmin access tokens to prevent unauthorized exploitation.
  • Review and enforce strict controls on the domain-put endpoint to prevent malicious FileStore root path provisioning.
  • Monitor the AddOrUpdateMount and global-mail endpoints for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart