Skip to content
Fencer Vulns
critical 9.8

CVE-2019-7214 in the critical feed json

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.

published 2019-04-24 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16758

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
84.9%
EPSS 84.9% chance of exploitation in 30 days, percentile 99.7%
public exploits
2
Metasploit, Exploit-DB

Summary

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Patch / fix

  • smartertools smartermail 16.3.6985

Timeline

  1. First public exploit (Metasploit exploit/windows/http/smartermail_rce)
  2. Published

Exploit prediction

84.94% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/http/smartermail_rce SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution metasploit exploit, excellent rank, 2019-04-17
  • EDB-49216 SmarterMail Build 6985 - Remote Code Execution remote, 2020-12-09
  • smartertools.com https://www.smartertools.com/smartermail/release-notes/current referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.