Threats / SmarterTools / CVE-2026-24423
CVE-2026-24423
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-06
SmarterTools SmarterMail vulnerability
SmarterMail's ConnectToHub API method lacks authentication for critical functions, allowing unauthenticated attackers to redirect the service to malicious servers and execute arbitrary OS commands.
Verdict
Today item, not a backlog item.
An unauthenticated remote attacker can exploit missing authentication controls in the ConnectToHub API to redirect SmarterMail to a malicious HTTP server, retrieve and execute arbitrary OS commands, and potentially compromise the entire mail server infrastructure.
01
Is it exploitable?
— the evidence, ranked above the scoreExploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-02-05), flagged for known ransomware use.
Probability (EPSS)
EPSS 0.83401 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: SmarterTools, SmarterMail. Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-306 Missing Authentication — weakness family: Authentication.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No threat-actor attribution is established from the public feed for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I identify that the ConnectToHub API method lacks authentication requirements for critical operations.
Business
The organization has no access control preventing unauthorized API calls to core mail server functions.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I craft an unauthenticated request to redirect the SmarterMail instance to a malicious HTTP server under my control.
Business
The mail server trusts and connects to an attacker-controlled endpoint without verification.
3
Lateral reach — past segmentation narrative 3
Attacker
I serve malicious OS commands from my server that the SmarterMail instance retrieves and executes with server privileges.
Business
Arbitrary code execution occurs on the mail server with full system-level permissions.
4
Data at risk — exfiltration narrative 4
Attacker
I establish persistent access, exfiltrate sensitive email data, and deploy ransomware across the infrastructure.
Business
Complete compromise of mail services, data breach, operational shutdown, and financial extortion through ransomware deployment.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05
Coverage & confidence
— what we know, and what we don’tEstablished (cited)
Coverage gaps — stated, not hidden
Disclosure & credit2
Catalogued by VulnCheckCNA
Credited with finding itSina Kheirkhah & Piotr Bazydlo of watchTowrfinderMarkus Wulftange of CODE WHITE GmbHfinderCale Black of VulnCheckfinder