ZeroDay Findings
Sign inSign up

Findings

CVE-2026-24423

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Published Jan 23, 2026 · updated Aug 3, 2026 · SmarterTools SmarterMail

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 23, 2026 · Catalog

    Detected

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

  2. Feb 5, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Feb 26, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Aug 3, 2026 · Catalog

    Updated

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 26, 2026

Affected

  • cpe smartertools/smartermailversion unspecified
  • vendor SmarterTools SmarterMailversion unspecified

Sources

  • CISA KEVCVE-2026-24423

    SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

    cisa.gov
  • CVE.orgCVE-2026-24423

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-24423

    30-day exploitation probability 88.2%

    first.org
  • NIST NVDCVE-2026-24423

    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be

    nvd.nist.gov

References

CVE-2026-24423 · ZeroDay Findings