CVE-2025-52691

10.0 CRITICAL CISA KEV - Actively Exploited

Published: December 29, 2025 Modified: January 27, 2026

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Third Party Advisory

https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

3 reference(s) from NVD

Quick Stats

CVSS v3 Score

10.0 / 10.0

EPSS (Exploit Probability)

79.9%

99th percentile

Exploitation Status

Actively Exploited

Remediation due: 2026-02-16

Weaknesses (CWE)

CWE-434

Affected Vendors

smartertools

Related CVEs