CVE-2026-24423 SmarterTools SmarterMail Missing Authentication for Critical Function

Exploited in the wild Critical 9.3 Published 23 Jan 2026 Updated 4 Aug 2026

Unauthenticated attackers can execute arbitrary OS commands on SmarterMail servers by directing the ConnectToHub API to a malicious HTTP server.

Exploited in the wild: Since 5 Feb 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24423?

CVE-2026-24423 is a critical command injection vulnerability in SmarterTools SmarterMail, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Weakness: CWE-306

Which versions are affected by CVE-2026-24423?

It affects 1 product.

Products include Smartertools Smartermail.

How do I fix CVE-2026-24423?

No fix has been published for CVE-2026-24423 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 26 Feb 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-24423 being exploited?

Yes. Attackers have exploited CVE-2026-24423 in the wild since at least 5 Feb 2026, including in ransomware campaigns.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-7jpw-fm5p-f98m.