Executive Summary
VulnCheck research has identified a critical vulnerability, CVE-2026-24423, in SmarterTools SmarterMail servers prior to version 100.0.9511. This flaw resides in the `connect-to-hub` API endpoint, which fails to require authentication and allows an adversary to define arbitrary commands during the mounting process.
The attack chain involves an adversary sending a POST request to a vulnerable server, forcing it to communicate with an attacker-controlled 'hub' server. The hub server then provides a malicious JSON response containing command execution parameters that are processed and executed with high privileges on the target host.
This vulnerability is of high urgency as it facilitates unauthenticated initial access and has reportedly been exploited in the wild for ransomware attacks. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the immediate threat to organizations using unpatched mail servers.
Key Details
Threat Name
CVE-2026-24423
Affects
SmarterTools SmarterMail prior to version 100.0.9511
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified