Read the docs
TI-2025-42142 Aliases CVE-2025-68624GHSA-8wch-g3f4-9xpr

Authentication bypass by spoofing in N-able Mail Assure

Priority MEDIUM 53CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
N-ableMail Assureup to April 2026—No fix listedCNA
  • Mail Assure VendorN-able Affected up to April 2026 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68624
  2. 2026-10-03 Alias added: GHSA-8wch-g3f4-9xpr

References

Other 3

  • TI-2026-59007 pre-authentication remote code execution KEVCVSS 4.0CRITICAL 10.0
  • TI-2025-08126 Command injection in N-able N-central KEVCVSS 4.0CRITICAL 9.4
  • TI-2025-08125 Insecure deserialization in N-able N-central KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-15225 Incomplete patch leads to administrative account takeover KEVCVSS 4.0HIGH 8.2
  • TI-2026-15214 Unauthenticated administrative account takeover KEVCVSS 4.0HIGH 8.2
  • TI-2025-10725 N-central Multiple XXE Injection Vulnerabilities CVSS 4.0HIGH 8.4
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences