CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24423?
CVE-2026-24423 is considered a critical severity vulnerability due to its potential for unauthorized remote code execution.
How do I fix CVE-2026-24423?
To fix CVE-2026-24423, upgrade SmarterTools SmarterMail to version 9511 or later.
What does CVE-2026-24423 exploit?
CVE-2026-24423 exploits an unauthenticated remote code execution vulnerability in the ConnectToHub API.
What versions of SmarterMail are affected by CVE-2026-24423?
SmarterMail versions prior to build 9511 are affected by CVE-2026-24423.
Can CVE-2026-24423 be exploited remotely?
Yes, CVE-2026-24423 can be exploited remotely by pointing the affected SmarterMail instance to a malicious HTTP server.