CVE-2026-24423criticalunder attackransomwareCWE-306

CVE-2026-24423: critical vulnerability in SmarterTools SmarterMail

SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

Published · Updated

Follow this CVE+ Monitor SmarterMail

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 88%
from disclosure to weapon138 days
Published on NVDJan 23
1st PoC+138d
CISA KEV+13d
Action required by CISAfederal deadline: 2026-02-26

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SmarterMail versions before build 9511 allow anyone to run malicious commands on the server without needing a password, by tricking the application into connecting to an attacker-controlled server.

Technical detail

The ConnectToHub API method lacks authentication checks (CWE-306), allowing unauthenticated attackers to redirect the application to a malicious HTTP endpoint that serves arbitrary OS commands, resulting in remote code execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
SmarterTools · SmarterMail
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SmarterTools SmarterMail

In the same product, most dangerous first.

CVE-2026-23760CRITICALSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APIEPSS 96.4%KEVCVE-2025-52691CRITICALUpload Arbitrary FilesEPSS 85.7%KEVCVE-2026-26930HIGHCVE-2026-26930EPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%