What’s Vulnerable › Vulnerabilities

CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-02-05
• EPSS: 88.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-23 · updated 2026-08-04
• Weakness: CWE-306

Description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Affected products

• SmarterTools SmarterMail: before 100.0.9511 — fixed in 100.0.9511

How to fix

Upgrade to a fixed version: SmarterTools SmarterMail 100.0.9511. Check the vendor advisory for mitigations.

References

• https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail
• https://www.smartertools.com/smartermail/release-notes/current
• https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423

Get alerted when CVE-2026-24423 or the next vulnerability affects your stack