How severe is CVE-2026-40514?

CVE-2026-40514 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-40514 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40514?

CVE-2026-40514 affects Smartertools Smartermail. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40514?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40514 have an EU (EUVD) identifier?

Yes. CVE-2026-40514 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-25856.

When was CVE-2026-40514 published?

CVE-2026-40514 was published on 2026-04-27 and last updated on 2026-06-17.

CVE-2026-40514

CVE-2026-40514 is a medium-severity vulnerability in Smartertools Smartermail with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-338.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
CVSS v4: 8.2
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-25856
Weakness: CWE-338
Affected product: Smartertools Smartermail
Published: 2026-04-27
Last modified: 2026-06-17

Description

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

Frequently asked questions

What is CVE-2026-40514?: SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.
How severe is CVE-2026-40514?: CVE-2026-40514 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-40514 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40514?: CVE-2026-40514 affects Smartertools Smartermail. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40514?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40514 have an EU (EUVD) identifier?: Yes. CVE-2026-40514 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-25856.
When was CVE-2026-40514 published?: CVE-2026-40514 was published on 2026-04-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*

More vulnerabilities in Smartertools Smartermail

CVE-2025-52691 — Critical (CVSS 10.0): Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any…
CVE-2026-24423 — Critical (CVSS 9.8): SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in…
CVE-2026-23760 — Critical (CVSS 9.8): SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password…
CVE-2021-32234 — Critical (CVSS 9.8): SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
CVE-2019-7214 — Critical (CVSS 9.8): SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker…
CVE-2019-7212 — High (CVSS 8.2): SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access…

All CVEs affecting Smartertools Smartermail →

Other CWE-338 vulnerabilities

CVE-2026-56141 — Critical (CVSS 9.8): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account…
CVE-2026-3256 — Critical (CVSS 9.8): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults…
CVE-2025-15604 — Critical (CVSS 9.8): Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions…
CVE-2025-40926 — Critical (CVSS 9.8): Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session…
CVE-2026-2439 — Critical (CVSS 9.8): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id…
CVE-2025-15578 — Critical (CVSS 9.8): Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the…

Browse all CWE-338 vulnerabilities →