Tag

#vulnerability-disclosure

1 post tagged #vulnerability-disclosure.

Analysis · May 5, 2026 · The Field Notes Desk

SmarterMail fixed a CVSS 10 and told no one for two months

CVE-2025-52691 is a pre-auth RCE in SmarterMail's file upload API. SmarterTools patched it silently in October 2025 with no CVE, no advisory, and release notes that said 'critical security fixes.' watchTowr found the silent fix two months later. Here's why that matters.