This SmarterMail vulnerability allows Remote Code Execution - here's what we know
A maximum-severity flaw was just patched, and users are urged to apply the fix immediately.
Image Credit: Pixabay (Image credit: Geralt / Pixabay)
- SmarterMail patched CVE-2025-52691, a maximum-severity RCE flaw allowing unauthenticated arbitrary file uploads
- Exploitation could let attackers deploy web shells or malware, steal data, and pivot deeper into networks
- No confirmed in-the-wild abuse yet, but unpatched servers remain prime targets once exploit details circulate
Business-grade email server software SmarterMail just patched a maximum-severity vulnerability that allowed threat actors to engage in remote code execution (RCE) attacks.
In a short security advisory published on the Cyber Security Agency of Singapore (CSA) website, it was said that SmarterTools (the company behind SmarterMail) released a patch for CVE-2025-52691.
The National Vulnerability Database (NVD) does not describe the bug in detail but says that successful exploitation “could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.”
A patch brings the tool to build 9413, and admins are advised to upgrade as soon as possible.
Taking over servers
In theory, it means that an attacker with no credentials and no user interaction can send a specially crafted request to the server, which it then accepts and stores on its file system. Since the upload isn’t properly validated, the attacker can drop files in directories where the server will run or load them.
This means that the attackers could upload a web shell, malware, or a malicious script to take full control of the mail server. They can steal sensitive data, maintain persistent access, and even use the compromised server as an attack platform to pivot deeper into the network.
Furthermore, they can use the compromised servers to conduct phishing and spam campaigns, or simply disrupt service availability.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
So far, there is no evidence that it is actually happening. There are no reports of in-the-wild abuse, and the US Cybersecurity and Infrastructure Security Agency (CISA) did not add it to its Known Exploited Vulnerabilities (KEV) catalog yet.
However, just because a patch is released, that doesn’t mean the attacks won’t come. Many cybercriminals use patches as notifications of existing vulnerabilities, and then target organizations that don’t patch on time (or at all).
