CVE-2026-24423

CRITICALCISA KEV

9.8

Description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published1/23/2026

Last Modified2/6/2026

Sourcekev

Honeypot Sightings0

CISA KEV

VendorSmarterTools

ProductSmarterMail

Vulnerability NameSmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

KEV Date Added2026-02-05

Remediation Due Date2026-02-26

Ransomware UseKnown

Affected Products

smartertools:smartermail

Weaknesses (CWE)

CWE-306

References

https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail(disclosure@vulncheck.com)

https://www.smartertools.com/smartermail/release-notes/current(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api(disclosure@vulncheck.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.