This SmarterMail vulnerability allows Remote Code Execution - here's what we know

• SmarterMail patched CVE-2025-52691, a maximum-severity RCE flaw allowing unauthenticated arbitrary file uploads
• Exploitation could let attackers deploy web shells or malware, steal data, and pivot deeper into networks
• No confirmed in-the-wild abuse yet, but unpatched servers remain prime targets once exploit details circulate

Business-grade email server software SmarterMail just patched a maximum-severity vulnerability that allowed threat actors to engage in remote code execution (RCE) attacks.

In a short security advisory published on the Cyber Security Agency of Singapore (CSA) website, it was said that SmarterTools (the company behind SmarterMail) released a patch for CVE-2025-52691.

The National Vulnerability Database (NVD) does not describe the bug in detail but says that successful exploitation “could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.”