CVE-2026-24423: SmarterMail ConnectToHub API unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a CVSS 4.0 score of 9.3, KEV listing with known ransomware use, and very high EPSS make this an urgent patch-first issue.

What it is

SmarterTools SmarterMail builds prior to 9511 expose the ConnectToHub API method without authentication, allowing an attacker to redirect the application to an attacker-controlled HTTP server that returns an OS command. The application then executes that command, giving remote code execution on the mail server. Because it is unauthenticated and network-reachable, it is a severe pre-auth compromise path for internet-facing SmarterMail instances.

Impact

An unauthenticated attacker can execute arbitrary OS commands on the SmarterMail host, leading to full server compromise, data theft, and use of the host as a foothold for further intrusion.

Attack surface

Reachable over the network via the ConnectToHub API method; the CVSS 4.0 vector shows PR:N and UI:N, so no authentication or user interaction is required. The attacker only needs to control an HTTP server that SmarterMail will contact.

Exploitation

CISA added this to KEV on 2026-02-05 with known ransomware campaign use, and EPSS is 0.87988 (99.756th percentile), indicating active exploitation is expected or observed. No public exploit code details are provided in the record.

What to do

• Upgrade SmarterMail to build 9511 or later immediately.
• If patching is not possible, restrict network access to the SmarterMail web/API interface to trusted sources and block outbound HTTP from the server.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Isolate or rebuild any SmarterMail host that may have been exposed, and rotate credentials and secrets stored on it.
• Monitor vendor release notes for further guidance and confirm the installed build number after patching.

Detection

• Search SmarterMail logs for requests to the ConnectToHub API method, especially from unexpected or external source IPs.
• Monitor outbound HTTP connections from the SmarterMail server to unfamiliar or newly registered hosts.
• Alert on unexpected child processes spawned by the SmarterMail service (for example cmd.exe, powershell.exe, or shell).
• Review host and network telemetry for post-exploitation activity such as new services, scheduled tasks, or credential access on SmarterMail servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.