CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Other sources
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SmarterTools SmarterMailto a version that resolves this vulnerability.Fixed in Build 9511 - Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
- Compensating control
Discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24423?
CVE-2026-24423 is considered a critical severity vulnerability due to its potential for unauthorized remote code execution.
How do I fix CVE-2026-24423?
To fix CVE-2026-24423, upgrade SmarterTools SmarterMail to version 9511 or later.
What does CVE-2026-24423 exploit?
CVE-2026-24423 exploits an unauthenticated remote code execution vulnerability in the ConnectToHub API.
What versions of SmarterMail are affected by CVE-2026-24423?
SmarterMail versions prior to build 9511 are affected by CVE-2026-24423.
Can CVE-2026-24423 be exploited remotely?
Yes, CVE-2026-24423 can be exploited remotely by pointing the affected SmarterMail instance to a malicious HTTP server.