CVE-2026-24423

🗓️ 23 Jan 2026 16:53:34Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 232 Views🌐 WEB

CVE-2026-24423: SmarterMail before 9511 allows unauthenticated remote code execution via ConnectToHub.

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Missing Authentication for Critical Function in Smartertools Smartermail	2 Sep 202612:39	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Smartertools Smartermail	2 Sep 202612:39	–	githubexploit
attackerkb	CVE-2026-24423	23 Jan 202616:53	–	attackerkb
BDU FSTEC	The vulnerability of the API ConnectToHub method of the SmarterTools SmarterMail mail server allows a perpetrator to execute arbitrary code.	4 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-24423	23 Jan 202620:48	–	circl
CISA KEV Catalog	SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability	5 Feb 202600:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	5 Feb 202612:00	–	cisa
CNNVD	SmarterTools SmarterMail access control vulnerability	23 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-24423 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API	23 Jan 202616:53	–	cvelist
EUVD	EUVD-2026-4273	23 Jan 202616:53	–	euvd

NVD

Vulners

CNA

Node

smartertools smartermailRange<100.0.9511

[
  {
    "defaultStatus": "unaffected",
    "product": "SmarterMail",
    "vendor": "SmarterTools",
    "versions": [
      {
        "lessThan": "100.0.9511",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
code-white	www.code-white.com/public-vulnerability-list/
smartertools	www.smartertools.com/smartermail/release-notes/current
vulncheck	www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
hubAddress	request body	/api/v1/settings/sysadmin/connect-to-hub	Unauthenticated remote code execution via ConnectToHub by supplying a hubAddress that causes the target to load a malicious hub and execute the CommandMount payload.	CWE-306
oneTimePassword	request body	/api/v1/settings/sysadmin/connect-to-hub	Unauthenticated remote code execution via ConnectToHub by supplying a hubAddress that causes the target to load a malicious hub and execute the CommandMount payload.	CWE-306
nodeName	request body	/api/v1/settings/sysadmin/connect-to-hub	Unauthenticated remote code execution via ConnectToHub by supplying a hubAddress that causes the target to load a malicious hub and execute the CommandMount payload.	CWE-306
SystemMount.CommandMount	nested	/web/api/node-management/setup-initial-connection	Attacker-controlled hub endpoint returns a SystemMount with a CommandMount value that SmarterMail processes as an OS command, enabling RCE.	CWE-306

04 Aug 2026 05:16Current

8.6High risk

Vulners AI Score8.6

CVSS 3.19.8

CVSS 49.3

EPSS0.88177

SSVC