CVE-2025-52691

Upload Arbitrary Files

Exploited in attacks Used by ransomware Critical 10.0 Attack chance: 86%

What it is

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

CISA: SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 16, 2026

Added to the CISA list: January 26, 2026
Published: December 29, 2025
Severity: Critical 10.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 86% in the top 0.3% of all known vulnerabilities
Weakness: CWE-434
More details: NVD · CVE.org · CISA

All references (1)

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/

More exploited flaws from SmarterTools

Added	Vulnerability	Product	Severity	Attack chance
Feb 5, 2026	Missing Authentication for Critical FunctionCVE-2026-24423used by ransomware	SmarterMail	Critical 9.3	88%
Jan 26, 2026	Authentication Bypass Using an Alternate Path or ChannelCVE-2026-23760used by ransomware	SmarterMail	Critical 9.3	96%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.