CVE-2026-24423
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-24423 is a critical unauthenticated remote code execution vulnerability in SmarterTools SmarterMail caused by missing authentication on the ConnectToHub API method. With a CVSS v3.1 base score of 9.8, the flaw allows an unauthenticated network attacker to point SmarterMail to a malicious HTTP server that delivers an OS command, which the vulnerable application then executes. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 26, 2026, and critically, the ransomware association is classified as Known, confirming active use in ransomware campaigns. The EPSS score of 26.16% at the 96.2nd percentile places this among the most aggressively exploited vulnerabilities currently tracked, indicating extremely high exploitation activity targeting SmarterMail installations worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| smartertools | smartermail | < 100.0.9511 |
References
- https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail(Third Party Advisory)
- https://www.smartertools.com/smartermail/release-notes/current(Release Notes)
- https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2026-24423 is classified under CWE-306 (Missing Authentication for Critical Function). This weakness occurs when software exposes a critical function or endpoint without requiring any authentication, allowing any network-reachable attacker to invoke functionality that should be restricted to authorized administrators. In SmarterMail, the ConnectToHub API method is a critical administrative function that allows the server to connect to an external hub for configuration or data synchronization. Because this endpoint lacks authentication controls, an unauthenticated attacker can invoke it and direct the SmarterMail server to connect to an attacker-controlled HTTP server. The malicious server then serves an OS command payload that the SmarterMail application executes on the underlying operating system. This represents a fundamental security design failure where a high-privilege operation is accessible without any identity verification. Learn more about CWE-306
Impact Analysis
The impact of CVE-2026-24423 is catastrophic across all dimensions of the CIA triad, with the additional confirmed dimension of ransomware deployment. Confidentiality is completely compromised because the attacker achieves arbitrary command execution on the SmarterMail server, which processes and stores all organizational email data. This includes email contents, attachments, contact lists, calendar entries, address books, and potentially stored credentials. Email servers are among the highest-value targets in any organization because they contain the full breadth of business communications, sensitive negotiations, financial data, and personal information.
Integrity suffers maximum impact as the attacker can modify email data, inject forged messages, alter server configurations, create backdoor accounts, and use the compromised mail server as a trusted platform for internal phishing attacks. A compromised email server can be weaponized to send convincing phishing messages to employees, customers, and partners that bypass external email security controls because they originate from a legitimate internal server.
Availability faces critical risk, underscored by the Known ransomware association in the KEV entry. Threat actors are actively using this vulnerability to deploy ransomware that encrypts the mail server and its data stores, disrupting organizational email communications and demanding ransom for recovery. The EPSS score of 26.16% at the 96.2nd percentile confirms that this is among the top 4% of all tracked vulnerabilities by exploitation frequency. SmarterMail installations prior to build 9511 are affected, and given that SmarterMail is commonly deployed by small and mid-sized organizations and hosting providers, the attack surface is substantial.
Exploit Maturity
CVE-2026-24423 demonstrates exceptionally high exploit maturity with confirmed ransomware usage. The EPSS score of 26.16% at the 96.2nd percentile represents one of the highest exploitation probabilities among tracked vulnerabilities, meaning more than one in four exposed instances can expect exploitation attempts. CISA's KEV entry with a Known ransomware association and a remediation deadline of February 26, 2026 confirms that this vulnerability is being actively weaponized in ransomware campaigns. Third-party security research from Code White documents the vulnerability in the ConnectToHub API, and VulnCheck provides a detailed advisory on the unauthenticated RCE vector.
The exploitation mechanism is straightforward: the attacker sends an unauthenticated request to the ConnectToHub API endpoint, directing SmarterMail to connect to an attacker-controlled HTTP server. When SmarterMail fetches data from this malicious server, it receives and executes an OS command payload. This server-side request forgery pattern combined with command execution requires no special tools or expertise to exploit. The fact that ransomware groups have already incorporated this vulnerability into their toolkits means that exposed SmarterMail servers face not just data theft but complete encryption and extortion. SmarterMail's release notes document the fix in build 9511.
Remediation
-
Update SmarterMail to build 9511 or later immediately as this is the highest-priority remediation action. The vulnerability allows unauthenticated remote code execution and is being actively used in ransomware campaigns. Consult the SmarterMail release notes for upgrade instructions. Any delay in patching exposes the organization to ransomware deployment and complete email compromise.
-
Restrict network access to the SmarterMail administration interface as an emergency compensating control while upgrading. The ConnectToHub API endpoint should not be accessible from the internet or untrusted networks. Implement firewall rules to limit access to SmarterMail's administrative ports to trusted management IP addresses only. If possible, place the administration interface behind a VPN or reverse proxy with authentication.
-
Conduct an immediate forensic investigation of any SmarterMail server that was running a version prior to build 9511 and was accessible from untrusted networks. Review web server logs for requests to the ConnectToHub endpoint, check for outbound connections to unusual IP addresses, examine the system for newly created accounts, scheduled tasks, or unfamiliar processes, and verify that email data has not been exfiltrated or encrypted.
-
Rotate all credentials associated with the SmarterMail server and its environment after patching. This includes administrator passwords, service account credentials, database connection strings, SMTP relay authentication, and any API keys configured within SmarterMail. Assume that all credentials accessible from the compromised server have been captured by the attacker.
-
Implement email data backup verification and ensure that offline, immutable backups of email data exist. Given the confirmed ransomware association, having verified backups that are not accessible from the mail server is critical for recovery if ransomware deployment has already occurred or occurs before patching is complete.
Technical Details
CVE-2026-24423 is an unauthenticated remote code execution vulnerability in SmarterTools SmarterMail, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every component of the vector reflects maximum exploitability: Attack Vector (AV:N) confirms remote network exploitation. Attack Complexity (AC:L) means the exploit is reliable with no special conditions. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) keeps impact within the SmarterMail process context, which runs with sufficient privileges to execute OS commands.
The vulnerability exists in the ConnectToHub API method within the SystemAdminSettingsController. This method is intended to allow SmarterMail to connect to an external hub service for configuration synchronization or centralized management. The critical flaw is that this endpoint is exposed without any authentication check, meaning any network-reachable attacker can invoke it. The method accepts a URL parameter specifying the hub server to connect to. When invoked, SmarterMail initiates an outbound HTTP connection to the specified URL and processes the response. The attacker hosts a malicious HTTP server at the specified URL that returns a payload containing an OS command. SmarterMail's processing of the hub response includes command execution logic that runs the attacker-supplied command on the underlying operating system without sanitization or sandboxing.
This attack pattern combines two distinct vulnerability classes: missing authentication (CWE-306) on the API endpoint, and server-side request forgery leading to command execution when SmarterMail processes the malicious hub response. The fix in build 9511 addresses both aspects by adding authentication requirements to the ConnectToHub endpoint and implementing proper validation of hub server responses. All SmarterMail installations running builds prior to 9511 are affected.
Frequently Asked Questions
What is CVE-2026-24423?
CVE-2026-24423 is a critical unauthenticated remote code execution vulnerability in SmarterTools SmarterMail that allows attackers to execute arbitrary OS commands on the mail server without any credentials. It has a CVSS score of 9.8, an EPSS score of 26.16%, and is confirmed to be used in ransomware attacks.
Is CVE-2026-24423 being used in ransomware attacks?
Yes. CISA's KEV entry explicitly classifies the ransomware association as "Known," confirming that ransomware groups are actively exploiting this vulnerability to encrypt SmarterMail servers and their data stores. Organizations running vulnerable versions should treat this as an emergency.
Which versions of SmarterMail are affected?
All SmarterMail versions prior to build 9511 are affected. Organizations should update to build 9511 or later immediately by following the upgrade instructions in the SmarterMail release notes.
How does the attack work?
The attacker sends an unauthenticated request to the ConnectToHub API endpoint, directing SmarterMail to connect to an attacker-controlled server. That malicious server responds with a payload containing an OS command, which SmarterMail executes on the host system, giving the attacker full control.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.