Critical severity · published Jan 23, 2026
CVE-2026-24423
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
RansomwareIn wildKEV
9.8
CVSS
88.2%
EPSS
Yes
On KEV
Description
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 5, 2026
Federal remediation dueFeb 26, 2026
Ransomware campaign useKnown
Affected products
Which versions
SM
SmarterMail · SmarterTools
before 100.0.9511 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2026-24423: SmarterTools SmarterMail - SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
SMSmarterMailCVE-2026-24423
Feb 5, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24423
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24423
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
release-notes
https://www.smartertools.com/smartermail/release-notes/current
third-party-advisory
https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail
third-party-advisory
https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api
More from SmarterMail
10.0
CVE-2025-52691
Upload Arbitrary Files
9.8
CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
9.8
CVE-2021-32234
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution
9.8
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data
9.1
CVE-2026-40514
SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG