CVE-2026-24423 is a missing-authentication flaw in SmarterMail's ConnectToHub API method that lets an unauthenticated remote attacker redirect the mail server to a malicious HTTP server and have it execute an attacker-supplied OS command, and CISA records known use of this flaw in ransomware campaigns.
Vulnerability summary
| Vulnerability ID | CVE-2026-24423 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.8818 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-01-23T17:16:13.483 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| SmarterTools SmarterMail | cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* | Versions before build 100.0.9511 (fixed in build 9511 and later) |
What this means
CVE-2026-24423 (CWE-306, missing authentication for critical function) affects SmarterTools SmarterMail's ConnectToHub API method. NVD's description states that SmarterMail "versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method," where "the attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application" (NVD).
VulnCheck's advisory, credited as the discloser, confirms the root cause is that the ConnectToHub API "lacks proper authentication controls," so an attacker can direct a vulnerable instance toward an attacker-controlled server that serves an OS command the application then executes without verification — a classic unauthenticated-callback RCE pattern. VulnCheck lists the fixed release as build 9511 (VulnCheck: SmarterTools SmarterMail Unauthenticated RCE via ConnectToHub API).
NVD's own analysis scores the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; VulnCheck's own disclosure additionally scores it CVSS v4.0 9.3 (NVD).
CISA added CVE-2026-24423 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-02-05, with a required-action due date of 2026-02-26, and the catalog records "Known" use of this vulnerability in ransomware campaigns — one of only a handful of KEV entries with that designation (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.8818 (99.766th percentile), consistent with a widely scanned, actively-ransomware-linked, unauthenticated RCE against internet-facing mail infrastructure (FIRST EPSS).
Because the flaw requires no credentials and is tied to confirmed ransomware activity, any SmarterMail instance below build 9511 that is reachable from the internet should be upgraded immediately and reviewed for signs of prior compromise.
Evidence
- SmarterMail versions before build 9511 contain an unauthenticated RCE in the ConnectToHub API: the attacker points SmarterMail to a malicious HTTP server that serves a malicious OS command, which the application executes. — NVD
- The ConnectToHub API lacks proper authentication controls, allowing an attacker-controlled server to deliver an OS command executed without verification; fixed in build 9511. — VulnCheck
- CVSS v3.1 base score is 9.8 (critical) per NVD's own analysis, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; VulnCheck additionally scores it CVSS v4.0 9.3. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-02-05, due date 2026-02-26, with known ransomware campaign use. — CISA KEV
- EPSS score is 0.8818 (99.766th percentile) as of 2026-10-29. — FIRST EPSS