CVE-2025-68624

Cross‑Tenant Email Spoofing via Unrestricted MAIL FROM in N‑able Mail Assure

Published Sep 14, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

Analysis

Technical impact

This vulnerability arises from a design‑level authorization flaw in N‑able Mail Assure. When a user authenticates to the SMTP service, the server trusts all MAIL FROM addresses sent in the envelope without checking that the domain belongs to the tenant owning the credentials. As a result, an attacker from any tenant can send outbound mail that appears to come from other tenants. The flaw does not enable arbitrary code execution but allows email impersonation that can bypass SPF and DMARC checks, facilitating phishing, credential harvesting, or other deceptive campaigns.

Affected Systems

The affected product is N‑able Mail Assure.2026 release are vulnerable. The flaw exists in the shared SMTP relay architecture that does not enforce per‑tenant sender‑domain binding.

Risk and Exploitability

The vulnerability has a CVSS score of 4.3, indicating moderate severity. The EPSS score is < 1%, and it is not listed in the CISA KEV catalog. The flaw requires authentication via SMTP, which means that an attacker must have valid credentials on a tenant. Once authenticated, the attacker can send spoofed messages that will pass domain‑based authentication mechanisms. Because the design flaw is inherent to the architecture, the risk is confined to tenants that share the same SMTP relay instance. There is to log in can perform the abuse.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

N-able

Mail Assure

unknown

Version	Status	Constraints
`0`	affected	≤ April 2026

No data.

Vendor Product Versions

N-able

Mail Assure

Version	Status	Scheme	Platform
`[0,April 2026]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the vendor’s website for a patch or newer release that implements per‑tenant sender‑domain binding.
Restrict the MAIL FROM envelope to only authorized sender domains for each tenant, using server‑side filtering or custom MTA rules.
Enable logging of MAIL FROM changes and monitor outbound traffic for suspicious sender domains to detect spoofing attempts.
Consider isolating tenants by deploying separate SMTP relay instances instead of a shared architecture.

Generated by OpenCVE AI on September 15, 2026 at 16:04 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.336% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2026/Jun/10
https://deepsec.net/speaker.html#PSLOT782
https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92
https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf
https://www.n-able.com/products/mail-assure

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		N-able N-able mail Assure
Vendors & Products		N-able N-able mail Assure

Sep 17, 2026 5:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 4:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Cross‑Tenant Email Spoofing via Unrestricted MAIL FROM in N‑able Mail Assure

Sep 14, 2026 10:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	Design-level Authorization Flaw Enabling Cross‑Tenant Email Spoofing

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 12:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Design-level Authorization Flaw Enabling Cross‑Tenant Email Spoofing

Sep 14, 2026 1:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2026/Jun/10

Sep 14, 2026 12:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.
Weaknesses		CWE-290
References		https://deepsec.net/speaker.html#PSLOT782 https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92 https://www.n-able.com/products/mail-assure
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`