Which SIEM platforms have a CVE-2026-23760 detection rule?

df00tech provides CVE-2026-23760 (SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2026-23760 detection?

The CVE-2026-23760 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2026-23760?

Common false positives for CVE-2026-23760 include: Legitimate automated mail clients or monitoring tools polling SmarterMail APIs at high frequency; Internal IT administrators accessing admin panels via scripts or non-browser HTTP clients; Load balancers or health-check probes generating repeated requests to SmarterMail endpoints.

CVE-2026-23760 IBM QRadar · QRadar

Detect SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760) in IBM QRadar

Q: What data sources are required to detect SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760) (CVE-2026-23760)?

Detecting SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760) requires the following data sources: W3CIISLog, DeviceNetworkEvents.

Detects exploitation of CVE-2026-23760, an authentication bypass vulnerability (CWE-288) in SmarterTools SmarterMail. Attackers can access protected functionality through an alternate path or channel without valid credentials, potentially leading to unauthorized mailbox access, data exfiltration, or lateral movement. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic: Initial Access Credential Access

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  sourceip,
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  URL,
  "HTTP Method" AS http_method,
  "HTTP Response Code" AS response_code,
  "User-Agent" AS user_agent,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%'
  AND (
    URL ILIKE '%/api/%'
    OR URL ILIKE '%/autodiscover/%'
    OR URL ILIKE '%/ews/%'
    OR URL ILIKE '%/mapi/%'
    OR URL ILIKE '%/admin%'
    OR URL ILIKE '%/config%'
  )
  AND "HTTP Method" IN ('POST', 'GET', 'PUT')
  AND "HTTP Response Code" IN ('200', '201', '302')
  AND (
    URL ILIKE '%bypass%'
    OR URL ILIKE '%token=%'
    OR URL ILIKE '%auth=%'
    OR ("User-Agent" NOT ILIKE '%Mozilla%' AND URL ILIKE '%/api/%')
  )
  AND LOGSOURCENAME(logsourceid) ILIKE '%SmarterMail%'
GROUP BY sourceip, URL, http_method, response_code, user_agent, event_time
HAVING COUNT(*) > 5
LAST 30 MINUTES

critical severity medium confidence

AQL query for QRadar SIEM to detect suspicious authentication-bypass-indicative requests against SmarterMail IIS endpoints, grouped by source IP and resource path.

Data Sources

IIS Log SourceQRadar Network Activity

Required Tables

events

False Positives & Tuning

Scheduled tasks or integration middleware accessing SmarterMail APIs with non-standard user agents
IT management scripts automating mailbox configuration via API
Third-party email clients using legacy or custom HTTP client libraries

Other platforms for CVE-2026-23760

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Probe SmarterMail Admin API Without Credentials
Expected signal: IIS access log entry showing GET /api/v1/settings/sysadmin/general with HTTP 200 or 302, source IP of test host, user-agent 'python-requests/2.28'
Test 2Enumerate SmarterMail User Accounts via Bypass Path
Expected signal: IIS logs showing sequential requests to /api/v1/accounts, /autodiscover/autodiscover.xml, /ews/exchange.asmx with non-standard user-agent from a single IP within seconds
Test 3SmarterMail Authentication Bypass via Token Parameter Injection
Expected signal: Windows Event Log network connection events and IIS access log entries showing GET requests with 'token=', 'auth=', 'session=' query parameters, HTTP responses 200/302/401, user-agent 'TestClient/1.0'

Last updated: 2026-06-19 Research depth: standard

References (3)

Response Playbook

Triage

Identify the source IP(s) generating suspicious requests and determine whether they are internal, VPN egress, or external. Check threat intelligence feeds for reputation.
Review IIS access logs on the SmarterMail host for the implicated time window. Look for HTTP 200/302 responses to admin, config, or API paths accessed without standard authentication headers or session cookies.
Determine whether the accessed endpoints resulted in any data reads or writes: check for mailbox enumeration (GET /api/v1/accounts), configuration changes (POST /api/v1/settings), or file access patterns.
Correlate with Windows Security Event Log (Event ID 4624/4625) to assess whether OS-level logins occurred around the same time from the same IP.

Containment

Block the offending source IP(s) at the perimeter firewall and on the SmarterMail host's Windows Firewall immediately. If the IP is internal, isolate the originating host from the network.
If exploitation is confirmed, take the SmarterMail service offline or restrict access to trusted IP ranges only until the patch is applied and an integrity check is completed.

Evidence Collection

Collect and preserve IIS logs (C:\SmarterMail\Logs\ and IIS log directory) from the SmarterMail host covering the detection window. Hash files immediately after collection.
Export Windows Security, Application, and System event logs from the SmarterMail host. Capture a memory image if active exploitation or post-compromise activity is suspected.

Escalation Criteria

!Escalate immediately if the attacker accessed or modified admin accounts, global settings, or SMTP relay configuration — these indicate full platform compromise.
!Escalate if outbound SMTP traffic spiked after the suspicious requests, which may indicate the attacker turned SmarterMail into a spam relay or exfiltration channel.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>IIS access logs at the SmarterMail web root (default: C:\Program Files (x86)\SmarterTools\SmarterMail\MRS\App_Data\Logs\) showing requests to protected endpoints with 200/302 responses absent valid session cookies
>SmarterMail application event logs recording login events or admin actions not correlated with any known user session
>Windows Security Event Log entries (4624 Type 3 logon, 4768/4769 Kerberos ticket events) from the SmarterMail server host around the time of detected bypass activity
>Network flow records (NetFlow/IPFIX) showing sustained connections from external IPs to TCP 443/80/8080 on the SmarterMail host

Tuning Guidance

Baseline normal API polling rates and user-agent strings for legitimate SmarterMail integrations (e.g., mobile clients, calendar sync, third-party connectors) in your environment. Add those IPs or user-agent patterns to an allow-list to reduce false positives. Increase the request_count threshold if your environment has legitimate high-frequency API consumers. For environments with SmarterMail not exposed to the internet, lower the threshold to 3–5 requests. If SmarterMail is behind a reverse proxy, ensure source IP fields reflect the real client IP (X-Forwarded-For parsing), not the proxy address.

Hunting Queries

Retrospective 7-day hunt for unauthenticated or bypass-indicative access to SmarterMail API and mail protocol endpoints, useful for identifying earlier-stage reconnaissance or ongoing exploitation that predates the detection window.

Hunting — KQL

kql

W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/api/v1/", "/interface/root", "/autodiscover", "/ews", "/mapi")
| where scStatus in (200, 201, 302)
| where not(csUserAgent has "Mozilla") or csUriQuery has_any ("token=", "auth=", "bypass")
| summarize request_count=count(), uris=make_set(csUriStem), methods=make_set(csMethod) by cIP, bin(TimeGenerated, 1h)
| where request_count > 5
| order by request_count desc

Hunting — SPL

spl

index=iis sourcetype=iis earliest=-7d
| where match(uri_path, "(?i)/api/v1/|/interface/root|/autodiscover|/ews|/mapi")
| where status IN ("200","201","302")
| where NOT match(user_agent, "(?i)mozilla") OR match(uri_query, "(?i)token=|auth=|bypass")
| bin _time span=1h
| stats count AS req, dc(uri_path) AS paths, values(uri_path) AS accessed BY _time, src_ip
| where req > 5
| sort - req

Atomic Red Team Tests

Test 1 Probe SmarterMail Admin API Without Credentials

linux

Simulate an authentication bypass attempt by sending unauthenticated HTTP requests directly to SmarterMail administrative API endpoints to observe whether they return 200 responses or redirect to authenticated content.

Command

bash

TARGET="http://SMARTERMAIL_HOST/api/v1/settings/sysadmin/general"; curl -sk -o /dev/null -w "%{http_code} %{redirect_url}" -H "User-Agent: python-requests/2.28" "$TARGET"; curl -sk -o /tmp/sm_resp.txt -H "User-Agent: python-requests/2.28" "$TARGET"; head -c 500 /tmp/sm_resp.txt

Cleanup

bash

rm -f /tmp/sm_resp.txt

Expected Telemetry

IIS access log entry showing GET /api/v1/settings/sysadmin/general with HTTP 200 or 302, source IP of test host, user-agent 'python-requests/2.28'

Expected Detection

Detection fires on non-Mozilla user-agent accessing /api/ endpoint with 200/302 response from IIS log correlation rule

Test 2 Enumerate SmarterMail User Accounts via Bypass Path

linux

Attempt to enumerate mailbox accounts through the SmarterMail API using an alternate endpoint path that may not enforce authentication, simulating CWE-288 alternate channel abuse.

Command

bash

TARGET_HOST="SMARTERMAIL_HOST"; for path in "/api/v1/accounts" "/interface/root#accounts" "/autodiscover/autodiscover.xml" "/ews/exchange.asmx"; do echo "=== $path ==="; curl -sk -o /dev/null -w "HTTP %{http_code}\n" -H "User-Agent: ExchangeServicesClient/0.0.0.0" "http://$TARGET_HOST$path"; done

Cleanup

bash

No persistent artifacts created

Expected Telemetry

IIS logs showing sequential requests to /api/v1/accounts, /autodiscover/autodiscover.xml, /ews/exchange.asmx with non-standard user-agent from a single IP within seconds

Expected Detection

Detection fires on multi-URI access pattern from single IP with non-Mozilla user-agent returning 200/302 responses

Test 3 SmarterMail Authentication Bypass via Token Parameter Injection

windows

Attempt to access protected SmarterMail resources by injecting authentication parameters directly into the query string, testing for CWE-288 alternate authentication channel weaknesses.

Command

powershell

$host = "SMARTERMAIL_HOST"; $paths = @("/api/v1/settings/general?token=test", "/api/v1/accounts?auth=admin", "/webmail/?session=bypass"); foreach ($path in $paths) { $uri = "http://$host$path"; try { $r = Invoke-WebRequest -Uri $uri -Method GET -UserAgent "TestClient/1.0" -UseBasicParsing -TimeoutSec 5 -ErrorAction SilentlyContinue; Write-Output "$uri -> $($r.StatusCode)" } catch { Write-Output "$uri -> ERROR" } }

Cleanup

powershell

No persistent artifacts; close any established sessions

Expected Telemetry

Windows Event Log network connection events and IIS access log entries showing GET requests with 'token=', 'auth=', 'session=' query parameters, HTTP responses 200/302/401, user-agent 'TestClient/1.0'

Expected Detection

Detection fires on suspicious query parameter patterns (token=, auth=, session=) on protected SmarterMail paths with successful response codes

Related Detections

Tactic Hubs

TA0001Initial Access TA0006Credential Access

Related Techniques

T1190Exploit Public-Facing Application T1078Valid Accounts T1114Email Collection

Detect SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760) in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-23760

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-23760

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox