SmarterMail MailService Spawning Shell (CVE-2026-24423 CommandMount)

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•4

Detects the SmarterMail service process spawning cmd.exe /c or bash/sh -c, consistent with command injection via the unauthenticated connect-to-hub API (CVE-2026-24423). Parent match is limited to MailService or SmarterMail install paths to reduce noise.