N-able Mail Assure up to April 2026 improper authorization ⚔ [Disputed]

Summaryinfo

A vulnerability was found in N-able Mail Assure up to April 2026. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2025-68624. It is possible to launch the attack remotely. No exploit is available. The real existence of this vulnerability is still doubted at the moment. This product operates as a managed service, which prevents users from maintaining vulnerability countermeasures themselves.

Detailsinfo

A vulnerability was found in N-able Mail Assure up to April 2026. It has been declared as problematic. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity. CVE summarizes:

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.

The advisory is shared for download at n-able.com. This vulnerability was named CVE-2025-68624 since 12/19/2025. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/14/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

The real existence of this vulnerability is still doubted at the moment.

This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• N-able

Name

• Mail Assure

Version

• April 2026

Managed Service

• yes

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion