Smartermail
CVE-2026-24423
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to ConnectToHub API
-
ExploitPoint SmarterMail to malicious HTTP server
-
ImpactExecute attacker-controlled OS command as application user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | SmarterMail versions prior to build 9511 with ConnectToHub API endpoint exposed. No special conditions — remote unauthenticated exploitation against default SmarterMail installations. |
| Impact | CVSS 9.8 (Critical). KEV-listed — actively exploited. EPSS 29.3%. No authentication required. Remote code execution as SmarterMail service account. Chainable with CVE-2026-23760 (auth bypass) for complete compromise. Affects all SmarterMail installations before build 9511. |
| Exploit ScenarioDerived | An attacker sets up a malicious HTTP server that mimics the SmarterMail hub protocol. They send an unauthenticated request to the target's ConnectToHub API with the URL of their malicious server. SmarterMail connects to the attacker's server and receives crafted responses containing OS commands, which are executed in the context of the SmarterMail service. This provides full server-level access, enabling data theft, persistence, and lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SmarterTools SmarterMail prior to build 9511 contains a second critical vulnerability (CVE-2026-24423) — an unauthenticated remote code execution flaw in the ConnectToHub API method. An attacker can redirect the SmarterMail server to connect to a malicious HTTP endpoint that serves OS commands for execution. KEV-listed with EPSS 29%, this is chainable with CVE-2026-23760 for complete server compromise.
Earlier versions of this analysis (1)
SmarterMail's ConnectToHub API method (CWE-306) lacks authentication and allows attackers to specify an arbitrary HTTP server URL. The SmarterMail server connects to the attacker-controlled endpoint and executes commands received from it.
RemediationAI
Upgrade SmarterMail to build 9511 or later immediately. Block outbound HTTP connections from the SmarterMail server except to known legitimate destinations. Restrict access to the ConnectToHub API endpoint via firewall. Audit for unauthorized hub connections in server logs.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ConnectToHub functionality is designed to connect SmarterMail instances for multi-server deployments. The API endpoint does not require authentication and accepts a user-supplied URL. When SmarterMail connects to this URL, it processes the response as hub commands, which can include OS command execution. The attack requires the attacker to run an HTTP server that mimics the hub protocol and returns malicious commands.
Know when Smartermail gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
Executive ViewAI
SmarterMail servers are vulnerable to unauthenticated remote code execution attacks that are actively being exploited in the wild. Organizations running affected versions face immediate risk of complete system compromise, data breach, and operational disruption without urgent mitigation action.
Implement Web Application Firewall (WAF) rules to block unauthenticated ConnectToHub API requests; restrict network access to SmarterMail servers via IP whitelisting; segment email infrastructure from general network; disable ConnectToHub feature if operationally feasible; enforce strict egress filtering to prevent outbound connections to attacker-controlled servers; implement real-time log monitoring and alerting for suspicious API calls.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Smartermail
View allUnauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Full administrative takeover of SmarterTools SmarterMail (builds prior to 9511) is possible because the force-reset-pass
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. Rated critical severity (CVSS
SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. Rated high severity (CVSS 8.2), this vulnerab
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. Rated critical severity (CVS
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appoint
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skip
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG docu
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token
Authenticated attackers can read arbitrary JSON files from SmarterMail servers prior to build 9560 through a path traver
Remote code execution in SmarterMail builds before 9777 allows an attacker who already holds a SysAdmin-scoped access to
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web sc
GitHub PoC
Exploit-DB