VulnHub

Real-time Cybersecurity News

Critical

Critical SmarterMail vulnerability under attack, no CVE yet

Security Affairs
Actively Exploited
CVEVulnerabilityPatchCritical

Overview

A serious vulnerability in SmarterTools' SmarterMail, identified as WT-2026-0001, is currently being exploited by attackers, just two days after a patch was released on January 15, 2026. Despite the urgency, the flaw has not yet been assigned a CVE identifier, which makes tracking and public awareness more challenging. This vulnerability could potentially affect organizations using SmarterMail, putting their email systems at risk. Given the rapid exploitation, companies relying on this software should prioritize applying the latest patch to safeguard their systems. Users are advised to remain vigilant and monitor their systems for any unusual activity that may indicate a breach.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: SmarterTools SmarterMail
  • Action Required: Apply the patch released on January 15, 2026.
  • Timeline: Newly disclosed

Original Article Summary

A SmarterMail flaw (WT-2026-0001) is under active attack just days after its January 15 patch, with no CVE assigned yet. A newly disclosed flaw in SmarterTools SmarterMail is being actively exploited just two days after a patch was released. The issue, tracked as WT-2026-0001 and lacking a CVE, was fixed on January 15, 2026, with […]

Impact

SmarterTools SmarterMail

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Apply the patch released on January 15, 2026. Monitor systems for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Patch, and 1 more.

Read Original Article

Related Coverage

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

BleepingComputer

FulcrumSec has announced that it successfully hacked into the Manchester Airports Group, stealing 86 GB of sensitive data. This breach reportedly includes detailed information about travelers, including personal details, booking history, and travel itineraries, which go beyond what the airport initially revealed. BleepingComputer was able to verify at least one of the compromised traveler records, highlighting the seriousness of the breach. The implications of this incident are significant, as it raises concerns about the security of personal data held by large organizations like airports. Travelers and customers of Manchester Airports Group should be vigilant about their personal information and any potential impacts from this data theft.

Aug 30, 2026

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

BleepingComputer

Anthropic has issued a warning to users of its AI assistant, Claude, regarding a new infostealer malware threat. This malware compromises users' computers, stealing active login sessions for Claude and allowing attackers to access these accounts and consume their usage. The situation poses a significant risk as it could lead to unauthorized access and potential data breaches for affected users. The company emphasizes the importance of securing personal devices to prevent such attacks. Users are advised to check for malware on their systems and take appropriate security measures to protect their accounts.

Aug 30, 2026

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

The Hacker News

Recent security research has revealed serious vulnerabilities in several popular WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These flaws could allow attackers to bypass authentication, take over accounts, and execute arbitrary code on affected sites. The most critical vulnerability, CVE-2026-76581, has a CVSS score of 9.8, indicating a high level of risk. Website owners using these plugins and themes are strongly advised to take immediate action to secure their sites, as the potential for exploitation is significant. Addressing these vulnerabilities is crucial to protect user data and maintain the integrity of web applications.

Aug 29, 2026

Hasbro Data Breach Exposed Employee Personal Information

SecurityWeek

Hasbro has confirmed a data breach that exposed personal information of its employees, following a cyberattack earlier this year. The company experienced significant disruptions due to this attack, and now it is revealing that sensitive employee data may have been compromised. While the exact nature of the exposed information has not been detailed, this incident raises concerns about the security of employee data at large companies. Such breaches can lead to identity theft and other malicious activities, making it essential for companies to bolster their cybersecurity measures. Employees and stakeholders are advised to stay vigilant and monitor for any suspicious activity related to their personal information.

Aug 29, 2026

McKesson discloses breach after ShinyHunters claims patient data theft

BleepingComputer

McKesson, a major player in healthcare and pharmaceutical distribution, has reported a cybersecurity incident involving unauthorized access to its third-party applications. The ShinyHunters hacking group claims to have stolen an alarming 284 million patient records, raising serious concerns about data privacy and security in the healthcare sector. This breach could potentially expose sensitive information of millions of patients, emphasizing the vulnerability of healthcare systems to cyberattacks. As the situation develops, it is crucial for patients and healthcare providers to be aware of the implications, particularly regarding identity theft and the misuse of personal information. McKesson's disclosure serves as a stark reminder of the ongoing challenges faced by organizations in safeguarding their data against increasingly sophisticated cybercriminals.

Aug 28, 2026

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

The Hacker News

Berlin's state government has confirmed that it is facing an extortion attempt after hackers compromised the city's administrative network in August. The attackers have demanded a ransom, but officials have stated they will not pay. Forensic investigations have revealed additional data leaks, particularly affecting the Senate Department for Mobility, Transport, Climate Protection and Environment. This incident raises concerns about the security of public sector data and the potential risks of similar attacks on other cities and government entities. The refusal to pay may embolden attackers, while also highlighting the ongoing challenges of cybersecurity in public administration.

Aug 28, 2026