Vulnerability · Published Apr 27, 2026 · Assigned by VulnCheck

CVE-2026-40514SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

Medium 5.9

In plain English

A medium-severity security flaw in SmarterMail from SmarterTools Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 95.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

Affected products (as reported)

Vendor	Product	Versions
SmarterTools Inc.	SmarterMail	0 – before 100.0.9610

Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.smartertools.com/smartermail/release-notes/current release-notes, patch
https://www.vulncheck.com/advisories/smartertools-smartermail-build-9610-cryptographic-weakness-via-weak-rng third-party-advisory