CRITICALCVSS 9.3KNOWN EXPLOITEDRANSOMWARE: KNOWN

CVE-2026-24423

CVE-2026-24423 updated by NVD

Published: 2026-02-05
Modified: 2026-09-21
Sources: cisa-kev, nvd

Summary

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-24423

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.