How severe is CVE-2026-24423?

CVE-2026-24423 has a CVSS 4.0 base score of 9.3 (CRITICAL). EPSS estimates a 88.2% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-24423: SmarterTools SmarterMail < Build 9511 Unauthenticated

Q: What is CVE-2026-24423?

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

CISA Known Exploited Vulnerabilities

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-02-05

Remediation due

2026-02-26

Ransomware

Known use

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://www.smartertools.com/smartermail/release-notes/current ; https://www.cve.org/CVERecord?id=CVE-2026-24423 ; https://nvd.nist.gov/vuln/detail/CVE-2026-24423

Description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Severity

CVSS 4.0 · CNA9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
SmarterTools	SmarterMail	0 to <100.0.9511

References

3 Links

Patches

https://www.smartertools.com/smartermail/release-notes/current

Third-party advisories

Record Details

Published

2026-01-23

Last updated

2026-08-04

Assigner (CNA)

VulnCheck

Credited to

Sina Kheirkhah & Piotr Bazydlo of watchTowr; Markus Wulftange of CODE WHITE GmbH; Cale Black of VulnCheck

More from SmarterTools

CVE-2026-237609.3

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

CVE-2025-5269110

Upload Arbitrary Files

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-306 · Missing Authentication for Critical Function

IAM Tools Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.