Executive brief
N-able Mail Assure is a cloud-based email relay service used by organizations to send outbound email. The service contains a design flaw that allows an authenticated user from one customer organization to send email impersonating domains belonging to other unrelated customers on the same platform. This enables phishing, business email compromise, and domain impersonation attacks that can bypass SPF and DMARC email authentication controls that recipients rely on to filter malicious mail.
Technical details
The vulnerability is an authentication bypass via spoofing (CWE-290) in the SMTP submission logic. When a user authenticates to the Mail Assure SMTP relay with valid credentials, the service validates the user's identity but fails to verify that the authenticated account is authorized to send mail from the claimed MAIL FROM domain. An attacker with valid SMTP credentials from any tenant can specify a sender domain belonging to a different, unaffiliated tenant, and the relay accepts the message. The attack requires network access to the SMTP port and valid compromised credentials, but no interaction with the target organization. The resulting messages pass SPF and DMARC validation at receiving MTAs because the relay's infrastructure is authorized in the target domain's SPF record. N-able disputes this classification, stating the behavior is by design in its shared relay architecture and that it does not represent per-tenant sender-domain binding.
Affected products
- N-able Mail Assure through April 2026
Timeline
- 2025-11: disclosed: Public disclosure at DeepSec Vienna 2025
- 2026-05: advisory: CVE-2025-68624 assigned with DISPUTED tag after MITRE TL-Root review
- 2026-04: other: N-able confirmed cross-tenant sender behavior to MITRE