SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score

🗓️ 30 Jan 2026 07:09:00Reported by The Hacker NewsType

SmarterMail fixes unauthenticated code execution CVE-2026-24423 and CVE-2026-23760 in build 9511, plus CVE-2026-25067

Reporter	Title	Published	Views	Family All 54
GithubExploit	Exploit for CVE-2026-23760	24 Jan 202612:30	–	githubexploit
ATTACKERKB	CVE-2026-23760	22 Jan 202614:35	–	attackerkb
ATTACKERKB	CVE-2026-24423	23 Jan 202616:53	–	attackerkb
BDU FSTEC	The vulnerability in the application programming interface of the SmarterTools SmarterMail mail server allows a malicious individual to update the administrator password to the default value and gain unauthorized access to the server.	26 Jan 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the API ConnectToHub method of the SmarterTools SmarterMail mail server allows a perpetrator to execute arbitrary code.	4 Feb 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SmarterTools SmarterMail mail server arises from the use of a name with an incorrect link, allowing a hacker to intercept the user’s account information.	4 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-23760	22 Jan 202615:50	–	circl
Circl	CVE-2026-24423	23 Jan 202620:48	–	circl
Circl	CVE-2026-25067	29 Jan 202605:14	–	circl
CISA KEV Catalog	SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability	26 Jan 202600:00	–	cisa_kev