Which versions of Smartermail are affected by CVE-2026-24423?

SmarterMail servers are vulnerable to unauthenticated remote code execution attacks that are actively being exploited in the wild.

Is there a public PoC exploit available for CVE-2026-24423?

Yes, a public proof-of-concept exploit is available for CVE-2026-24423. Prioritise patching immediately. EPSS: 29.3%.

How to fix or mitigate CVE-2026-24423?

Within 24 hours: Identify all SmarterMail instances and versions in your environment; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network-level controls (WAF rules, IP whitelisting) to restrict ConnectToHub API access; monitor logs for exploitation attempts. Within 30 days: Contact SmarterTools for patch availability and timeline; plan emergency patching upon release; consider alternative email solutions if patch is delayed beyond 30 days.

Smartermail CVE-2026-24423

Q: What is the CVSS score of CVE-2026-24423?

CVE-2026-24423 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 29.3%.

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-01-23 disclosure@vulncheck.com

RCE Command Injection Smartermail Authentication Bypass

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 04, 2026 - 05:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Added to CISA KEV

Feb 06, 2026 - 16:45 cisa

CISA KEV

CVE Published

Jan 23, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

AnalysisAI

SmarterTools SmarterMail prior to build 9511 contains a second critical vulnerability (CVE-2026-24423) — an unauthenticated remote code execution flaw in the ConnectToHub API method. An attacker can redirect the SmarterMail server to connect to a malicious HTTP endpoint that serves OS commands for execution. KEV-listed with EPSS 29%, this is chainable with CVE-2026-23760 for complete server compromise.

Technical ContextAI

The ConnectToHub functionality is designed to connect SmarterMail instances for multi-server deployments. The API endpoint does not require authentication and accepts a user-supplied URL. When SmarterMail connects to this URL, it processes the response as hub commands, which can include OS command execution. The attack requires the attacker to run an HTTP server that mimics the hub protocol and returns malicious commands.

RemediationAI

Upgrade SmarterMail to build 9511 or later immediately. Block outbound HTTP connections from the SmarterMail server except to known legitimate destinations. Restrict access to the ConnectToHub API endpoint via firewall. Audit for unauthorized hub connections in server logs.