EXPOSURES › CVE-2026-24423
CVE-2026-24423
CRITICAL ⌖ ON CISA KEV · EXPLOITEDSmarterMail's ConnectToHub API lacks authentication, allowing attackers to redirect traffic to a malicious server for remote command execution.
The missing authentication on the ConnectToHub API lets an attacker point the mail server to a malicious HTTP endpoint that delivers OS commands, resulting in remote code execution. DIB organizations must patch this immediately because it is actively exploited in the wild and linked to ransomware, directly violating CMMC/NIST 800-171 requirements for patch management and access control. Verify all SmarterMail instances are updated and monitor for unauthorized outbound connections.
Shame score — A critical missing authentication flaw in a widely deployed mail server was actively exploited in the wild and linked to ransomware, demonstrating severe negligence and avoidable risk.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.