{"id":"CVE-2026-24423","published":"2026-01-23T17:16:13Z","modified":"2026-08-04T05:16:38Z","title":"SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability","vendor":"SmarterTools","product":"SmarterMail","tier":"core","eol":null,"description":{"text":"SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.","provenance":"source","from":"NVD"},"summary":{"text":"The SmarterTools SmarterMail mail server contains a missing-authentication flaw in its ConnectToHub API method, in versions prior to build 9511. An unauthenticated remote attacker with network access can cause the server to fetch a malicious OS command from an HTTP server they control, which the vulnerable application then executes.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.88177,"percentile":0.99766,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-02-05","dueDate":"2026-02-26","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.smartertools.com/smartermail/release-notes/current ; https://www.cve.org/CVERecord?id=CVE-2026-24423 ; https://nvd.nist.gov/vuln/detail/CVE-2026-24423","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-28","exploitedFirstSeen":"2026-02-05","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-02-05"},{"url":"https://tracker.crowdsec.net/cves/CVE-2026-24423","date":"2026-02-13"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://www.cyfirma.com/research/tracking-ransomware-march-2026/","date":"2026-04-08"},{"url":"https://ctrlaltintel.com/research/Qilin/","date":"2026-05-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-06-08&host_type=src&vulnerability=cve-2026-24423","date":"2026-06-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-06-09&host_type=src&vulnerability=cve-2026-24423","date":"2026-06-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-06-10&host_type=src&vulnerability=cve-2026-24423","date":"2026-06-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-06-12&host_type=src&vulnerability=cve-2026-24423","date":"2026-06-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-06-14&host_type=src&vulnerability=cve-2026-24423","date":"2026-06-14"}],"evidenceTotal":78,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail","tags":["Third Party Advisory"]},{"url":"https://www.smartertools.com/smartermail/release-notes/current","tags":["Release Notes"]},{"url":"https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method","start":54,"end":147}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker-supplied OS command executed by application","mappingType":"primary_impact","evidence":[{"from":"description","quote":"This command will be executed by the vulnerable application","start":259,"end":318}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-4273","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4273","exploited":true,"exploitedSince":"2026-02-05","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-01-29","earliestUrl":"https://github.com/aavamin/CVE-2026-24423","repos":[{"name":"aavamin/CVE-2026-24423","url":"https://github.com/aavamin/CVE-2026-24423","stars":9,"created":"2026-01-29"},{"name":"CyberAlp0/SmarterMail-CVE-2026-24423","url":"https://github.com/CyberAlp0/SmarterMail-CVE-2026-24423","stars":0,"created":"2026-09-02"}]},"nuclei":[{"id":"CVE-2026-24423","name":"SmarterMail - Remote Code Execution","severity":"critical","path":"http/cves/2026/CVE-2026-24423.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-24423.yaml"}],"first":{"date":"2026-01-29","source":"PoC-in-GitHub","url":"https://github.com/aavamin/CVE-2026-24423"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-01-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24423","provenance":"source"},{"date":"2026-01-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/aavamin/CVE-2026-24423","provenance":"source"},{"date":"2026-02-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2026-02-05","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-02-05","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4273","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":13},"priority":{"score":84.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 276 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}