SmarterMail-CVE-2026-24423

SmarterMail ConnectToHub RCE A Python-based exploit for CVE-2026-24423 , an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality. Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only...

CVE-2026-24423

CVE-2026-24423 CVE-2026-24423 – Reproduction ⚠️ 仅用于安全研究与授权测试 / For security research and authorized testing only 简介（Overview） 本项目用于复现 CVE-2026-24423 漏洞。 该漏洞存在于 SmarterMail ConnectToHub 功能中，其根本原因是： - 管理级接口未进行身份认证 - 服务端会主动连接用户指定的 Hub（SSRF） - 外部 Hub 返回的数据被直接用于本地系统级操作 该漏洞属于设计级信任边界破坏（Trust Boundary...

SmarterMail-CVE-2026-24423-

SmarterMail ConnectToHub RCE A Python-based exploit for CVE-2026-24423 , an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality. Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only...

Exploit for Missing Authentication for Critical Function in Smartertools Smartermail

SmarterMail ConnectToHub RCE A Python-based exploit for CVE...

Exploit for Missing Authentication for Critical Function in Smartertools Smartermail

SmarterMail ConnectToHub RCE A Python-based exploit for CVE...

SmarterMail < 100.0.9511 Unauthenticated RCE via ConnectToHub API (CVE-2026-24423)

The version of SmarterTools SmarterMail installed on the remote host is prior to 100.0.9511. It is, therefore, affected by a remote code execution vulnerability. SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHu...

SmarterMail API ConnectToHub Code Execution

The vulnerability of the API ConnectToHub method of the SmarterTools SmarterMail mail server is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2026-24423

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

CVE-2026-24423

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

CVE-2026-24423

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

CVE-2026-24423 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

CVE-2026-24423

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

CVE-2026-24423

CVE-2026-24423 affects SmarterTools SmarterMail builds prior to 9511, where the ConnectToHub API exposes an unauthenticated remote code execution. The vulnerability allows an attacker to direct a SmarterMail instance to a malicious HTTP server that serves an OS command executed by the vulnerable ...

CVE-2026-24423: Missing Authentication for Critical Function

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

SmarterTools SmarterMail access control vulnerability

SmarterTools SmarterMail is a set of email server software developed by SmarterTools Corporation. This software supports features such as spam filtering, data statistics, and Simple Mail Transfer Protocol SMTP authentication. Versions of SmarterTools SmarterMail prior to build 9511 had an access...

PT-2026-5794

Уязвимость метода API ConnectToHub почтового сервера SmarterTools SmarterMail связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

PT-2026-4520

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to build 9511 Description An issue exists in the 'ConnectToHub' API method, specifically at the endpoint '/api/v1/settings/sysadmin/connect-to-hub', due to missing authentication for a critical function...