CVE-2026-23760 in SmarterMail is an authentication bypass affecting the password reset endpoint that warrants different handling than typical high-severity CVEs. The critical distinction: exploiting this vulnerability does not land you at 'admin access' as an intermediate step. It lands you directly at SYSTEM or root on the host, because the SmarterMail admin panel contains built-in OS command execution functionality. The privilege escalation gap between 'authenticated user' and 'host compromise' has been collapsed entirely.
The EPSS score of 0.96268 places this in the extreme tail of exploitation probability—combined with CISA KEV listing and confirmed active exploitation, the operational imperative is clear: assume compromise has occurred, not that it might occur. Patching is necessary but insufficient. An attacker who has already reset admin credentials and executed host commands through the admin panel leaves no clean state to return to simply by applying the vendor patch.
Your response must be sequenced: first, isolate the affected system from the network to prevent lateral movement or data exfiltration during investigation. Second, reset ALL administrative credentials across the SmarterMail installation and any systems sharing those credentials—do not rely on a single password change. Third, audit for existing compromise by examining: (a) user accounts with admin privileges created or modified outside known administrative windows, (b) scheduled tasks or services added on the underlying Windows host, and (c) any unusual process execution or network connections originating from the SmarterMail server.
Note: the vulnerability is in the authentication layer (the password reset endpoint accepting arbitrary new credentials without token verification), not in the OS command execution features themselves. Those features are legitimate admin functionality. Your remediation targets the auth endpoint, not the admin panel's OS capabilities—disabling the latter would cripple legitimate mail server administration and does not address the actual flaw.
If your SmarterMail deployment lacks centralized logging for the password reset endpoint, treat that gap as an incident response limitation: the absence of evidence is not evidence of absence in this case. The high EPSS score and active exploitation confirm the threat actor's side has already moved past reconnaissance.