CVE-2025-68624
Quick assessment
Affected
N-able Mail Assure
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
截至 2026 年 4 月，N-able Mail Assure 存在一处设计层面的授权缺陷，允许已认证的 SMTP 用户使用属于其他租户的 MAIL FROM 地址发送出站邮件。当客户端通过 SMTP TCP 端口连接并使用有效凭证执行 SMTP AUTH 认证时，服务器会接受任意发件人域，而未强制实施域与账户之间的绑定关系。因此，来自任意租户的攻击者可以冒充其他租户的域发送邮件，这些邮件能够通过 SPF（发件人策略框架）和 DMARC（基于域的邮件认证、报告和一致性）验证。 注：N-able 的立场是，该行为是
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-68624
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| N-able | Mail Assure | 0 ~ April 2026 | - |
|
II. Public POCs for CVE-2025-68624
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68624
请登录查看更多情报信息。
Proof of Concept for CVE-2025-68624 (1)
Vendor Pages for CVE-2025-68624 (1)
IV. Related Vulnerabilities
Same vendor: N-able
-
CVE-2026-86218
pre-authentication remote code execution -
CVE-2026-86206
Access control filter bypass allows unauthorised access to A -
CVE-2026-86207
Authentication bypass leads to unauthorised access to N-cent -
CVE-2026-15580
PassPortal browser extension: vault token disclosure via unv -
CVE-2026-18577
Incomplete patch leads to administrative account takeover
Same weakness: CWE-290
-
CVE-2026-90447
Apache Shiro 5.3.5 认证路由逻辑漏洞 -
CVE-2026-45056
Matrix Rust SDK: Sender-binding gaps in to-device and room-k -
CVE-2026-63427
Lenovo Software Fix 认证绕过致特权执行漏洞 -
CVE-2026-88011
Traefik: ForwardAuth identity spoofing via dot-form header a -
CVE-2026-66674
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Cap
V. Comments for CVE-2025-68624
No comments yet