Because of CVE-2026-7807 APP Passwords, and 2FA Secrets may have been exposed thru a security issue with JSON files.

What this means all end users will be forced into APP Passwords, and 2FA change with SmarterMail Build 9375. When you setup 2FA then SmarterMail automatically turns on APP Passwords thus this represents logins for anyone using Outlook Classic, eM Client, Smart Phone eMail Clients, Tablet eMail Clients any eMail Client maybe FAX Machines and Firewalls to mention a few.

As an MSP, I know security is important and I have moved +85% of my customers using 2FA and App Passwords which is good. This seems like a bitter pill to swallow.

I would rather have this to be managed by me rather than forcing this to all customers at once as I have a 250 Mailbox License. What about folks who have 500 or 1000 Mailboxes. It would be awful to have all customers to try to call me at once.

Of course I would eMail everyone about this, however, I know lots of folks are simply going to be unable to help themselves.

I would like to see a feature to allow me to manage this in /interface/root#/sysadmin/password-requirements.