Is CVE-2025-68624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68624 being exploited in the wild.

How severe is CVE-2025-68624?

Medium severity, with a CVSS score of 4.3, published 14 September 2026.

Which products and versions are affected?

N-able Mail Assure through April 2026.

Is there a fix for CVE-2025-68624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-68624 attacked?

It is attacked over the network.

Am I affected by CVE-2025-68624?

Check whether you run N-able Mail Assure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68624: N-able Mail Assure cross-tenant email spoofing via SMTP

CVE-2025-68624 · Severity: medium · CVSS 4.3 · Published 2026-09-14

N-able Mail Assure is a cloud-based email relay service used by organizations to send outbound email. The service contains a design flaw that allows an authenticated user from one customer organization to send email impersonating domains belonging to other unrelated customers on the same platform. This enables phishing, business email compromise, and domain impersonation attacks that can bypass SPF and DMARC email authentication controls that recipients rely on to filter malicious mail.

Vendors: N-able.

Quick answers

Is CVE-2025-68624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68624 being exploited in the wild.
How severe is CVE-2025-68624?: Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?: N-able Mail Assure through April 2026.
Is there a fix for CVE-2025-68624?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-68624 attacked?: It is attacked over the network.
Am I affected by CVE-2025-68624?: Check whether you run N-able Mail Assure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass via spoofing (CWE-290) in the SMTP submission logic. When a user authenticates to the Mail Assure SMTP relay with valid credentials, the service validates the user's identity but fails to verify that the authenticated account is authorized to send mail from the claimed MAIL FROM domain. An attacker with valid SMTP credentials from any tenant can specify a sender domain belonging to a different, unaffiliated tenant, and the relay accepts the message. The attack requires network access to the SMTP port and valid compromised credentials, but no interaction with the target organization. The resulting messages pass SPF and DMARC validation at receiving MTAs because the relay's infrastructure is authorized in the target domain's SPF record. N-able disputes this classification, stating the behavior is by design in its shared relay architecture and that it does not represent per-tenant sender-domain binding.

Affected products

N-able Mail Assure through April 2026

Timeline

2025-11: disclosed: Public disclosure at DeepSec Vienna 2025
2026-05: advisory: CVE-2025-68624 assigned with DISPUTED tag after MITRE TL-Root review
2026-04: other: N-able confirmed cross-tenant sender behavior to MITRE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.