CVE-2026-40514 affects SmarterTools SmarterMail builds prior to version 9610. The vulnerability arises from the use of DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, limiting the seed space to approximately 19,000 values. This cryptographic weakness allows an unauthenticated attacker to leverage the attachment download endpoint as an oracle to recover the seed and subsequently derive encryption keys and initialization vectors. With these, the attacker can forge sharing tokens to access arbitrary emails, attachments, or file storage contents without prior access. The CVSS 4.0 base score is 8.2, indicating high severity. No vendor advisory or patch information is currently provided.

An unauthenticated attacker can exploit this vulnerability to bypass access controls on file and email sharing endpoints by forging sharing tokens. This allows unauthorized access to arbitrary emails, attachments, or file storage contents. The cryptographic weakness significantly reduces the complexity of key derivation, making token forgery feasible. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the affected endpoints and monitor for suspicious activity related to sharing token usage. Avoid relying on the affected versions of SmarterMail for sensitive file and email sharing. Do not assume the vulnerability is mitigated without vendor confirmation.