CVE-2026-24423 Known ransomware use

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

SmarterTools — SmarterMail

Added to KEV catalog: 5 February 2026
Federal remediation due date: 26 February 2026
Weakness classification (CWE): CWE-306

CISA Description

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.smartertools.com/smartermail/release-notes/current ; https://www.cve.org/CVERecord?id=CVE-2026-24423 ; https://nvd.nist.gov/vuln/detail/CVE-2026-24423

View on NVD View on MITRE CVE View full CISA catalog

More SmarterTools Vulnerabilities

CVE-2025-52691

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services