Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck
CVE-2026-104082SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
High 7.2
In plain English
A high-severity code injection in Smartermail from Smartertools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Smartertools | Smartermail | 0 – before Build 9777 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- Release Notes release-notes, patch
- Researcher Blog technical-description, exploit
- VulnCheck Advisory: SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount third-party-advisory