Read the docs
TI-2026-29261 Aliases CVE-2026-40514GHSA-j74m-34v4-rgqp

SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

Priority LOW 35CWE-338Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed SmarterMail (SmarterTools Inc.): 100.0.9610

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmarterToolsSmarterMailbefore 100.0.9610100.0.9610Patch availableCNA
  • SmarterMail VendorSmarterTools Affected before 100.0.9610 Fixed in 100.0.9610 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*before 100.0.9610VulnerableSmarterTools
  • cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* Versions before 100.0.9610 Vulnerable ·SmarterTools

Remediation

  • Fix · CNA SmarterMail (SmarterTools Inc.) Fixed in 100.0.9610

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40514
  2. 2026-10-03 Alias added: GHSA-j74m-34v4-rgqp

References

Patch 1

  • TI-2025-32755 Upload arbitrary files in SmarterTools SmarterMail KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-19690 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-19133 SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API KEVCVSS 4.0CRITICAL 9.3
  • TI-2019-05110 SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. CVSS 3.0CRITICAL 9.8
  • TI-2019-05109 SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. CVSS 3.0MEDIUM 6.5
  • TI-2021-12079 SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences