Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Exploited vulnerability
SmarterMail ConnectToHub flaw (CVE-2026-24423)
CVE-2026-24423
CVE-2026-24423 is a flaw in SmarterTools SmarterMail, a mail server.
- On CISA KEV
- CVE ID
- CVE-2026-24423
- CISA KEV
- Listed
- Affected product
- SmarterMail
- Exploited
- Yes
- Published
- January 2026
In short
CVE-2026-24423 is a flaw in SmarterTools SmarterMail, a mail server. One of its API calls, ConnectToHub, needs no login, so an outsider can make the server fetch and run an operating system command from a server they control. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2026-24423
- ProductSmarterTools SmarterMail
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpdate SmarterMail · Limit exposure
What it allows
An unauthenticated attacker can point a SmarterMail server at a malicious web server, which returns an operating system command that the mail server then runs. NVD shows CVSS v3.1 9.8 (assessed by NVD) and CVSS v4.0 9.3 (supplied by the CVE assigner).
Who is affected
Per NVD, SmarterMail versions before build 100.0.9511. The vendor's release notes list build 9511, dated 15 January 2026, as an important update with critical security fixes. The release notes opened do not name this CVE, so confirm the build with the vendor before relying on it.
NVD published the record on 23 January 2026. CISA added CVE-2026-24423 to its Known Exploited Vulnerabilities (KEV) catalog on 5 February 2026, with a due date of 26 February 2026. The KEV entry flags known use in ransomware campaigns.
The sources opened here do not state when exploitation first began and do not name an actor, so no actor is attributed. This page is deliberately short for that reason.
What to do
-
Update SmarterMail
Run build 9511 or later, the build NVD gives as the first without the flaw. Use the latest release listed in the vendor release notes.
-
Limit exposure
Mail servers face the internet by design. Put the admin interface and API behind a VPN or an allow list of administrator addresses.
-
Block unexpected outbound traffic
The attack makes the server fetch a command from a remote web server. Restrict outbound web traffic from the mail server to known destinations.
-
Detect and hunt
Review web and API logs for calls to ConnectToHub from unknown addresses, then look for new processes started by the SmarterMail service, new accounts and unexpected outbound connections. If the server ran an older build while exposed, treat it as possibly compromised.
Questions
What is CVE-2026-24423?
CVE-2026-24423 is a missing-authentication flaw in the ConnectToHub API call of SmarterTools SmarterMail. An outsider can point the server at a malicious web server, which returns an operating system command that the mail server then runs. NVD shows CVSS 9.8.
Which SmarterMail versions are affected?
Per NVD, SmarterMail versions before build 100.0.9511 are affected. The vendor's release notes list build 9511, dated 15 January 2026, as an important update, but they do not name this CVE, so confirm the build with the vendor.
Is CVE-2026-24423 being exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 5 February 2026 and flags known ransomware campaign use. The sources used do not state when exploitation began or name an actor.
How do I defend against CVE-2026-24423?
Update SmarterMail to build 9511 or later, put the admin interface and API behind a VPN or allow list, and restrict outbound web traffic from the mail server. Review logs for ConnectToHub calls from unknown addresses.
Sources
- SmarterMail release notes (build 9511) SmarterTools
- CVE-2026-24423 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.