CVE-2019-7214: SmarterMail deserialization of untrusted data enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required and very high EPSS, though real-world exposure is limited to hosts with port 17001 reachable.

What it is

SmarterTools SmarterMail 16.x before build 6985 deserializes untrusted data, letting an unauthenticated attacker execute commands on the server when port 17001 is remotely reachable. The port is not remotely accessible by default once the Build 6985 patch is applied, so exposure depends on whether that port was left open.

Impact

An attacker gains remote code execution on the mail server with no credentials, giving full control of the host and any mail data or credentials it holds.

Attack surface

Reached over the network via port 17001; the CVSS vector shows no privileges and no user interaction required. Exploitation is only possible where that port is remotely accessible, which the vendor states is not the default after the patch.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.848, ~99.7th percentile) and references include an exploit-tagged vendor release note plus public Packet Storm RCE write-ups, indicating public exploit code exists.

What to do

• Upgrade SmarterMail to build 6985 or later, which closes remote access to port 17001.
• Block port 17001 at the perimeter and host firewall; restrict it to trusted management hosts only.
• If the port must remain reachable, place it behind a VPN or authenticated jump host.
• Audit for prior compromise on hosts that had port 17001 exposed before patching.

Detection

• Monitor network flows and firewall logs for inbound connections to TCP 17001 from external addresses.
• Alert on unexpected child processes spawned by the SmarterMail service, especially shells or scripting interpreters.
• Review SmarterMail and OS logs for anomalous command execution or service restarts around the time of port 17001 connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.