CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

SmarterTools SmarterMail contains a missing authentication vulnerability in the ConnectToHub API method. An attacker can direct the server to retrieve and execute operating system commands from an attacker-controlled HTTP server. The issue is under active exploitation in ransomware campaigns, which makes prompt verification and response a priority for any organization running this email server software.

How it works

The weakness is classified as CWE-306, missing authentication for critical function. In the affected API method an unauthenticated caller can supply an external server address that the SmarterMail instance then contacts without further verification.

• The remote server can return content that the product treats as an operating system command, resulting in arbitrary command execution on the host.
• No prior authentication or authorization check is performed on the supplied endpoint, allowing the action from an unauthenticated network position.

Am I affected? How to find it in your systems

SmarterMail is an on-premises or self-hosted email server. Locate all instances by querying your asset inventory, network scans, or configuration management database for the product name and any associated web or SMTP ports.

• Review server configurations that reference the ConnectToHub method or external hub connectivity settings.
• Compare installed builds against the versions listed in the vendor advisory; do not rely on general version assumptions.
• Examine web server and application logs for unexpected outbound connections or requests containing external URLs that originate from the ConnectToHub code path.

How to remediate

Apply the vendor-supplied update that addresses the missing authentication check in the ConnectToHub API method. After patching, confirm that the updated code enforces authentication on the affected endpoint and that any previously supplied external hub addresses have been removed or reset.

• Disable or restrict the ConnectToHub feature if it is not required in your environment.
• Enforce network-level controls that limit which external hosts the server is permitted to contact.

If you can't patch immediately

Follow the mitigations published in the vendor advisory. Where the product is used as a cloud service, apply the controls required by CISA BOD 22-01. If mitigations cannot be implemented, discontinue use of the affected instance until a fix is applied.

• Segment the server so that only authorized management hosts can reach its management interfaces.
• Monitor outbound traffic from the server for connections to previously unseen external addresses.
• Consider virtual patching or request filtering at a web application firewall or reverse proxy to block unauthenticated calls to the ConnectToHub method.

If your data may have been exposed

Because the vulnerability is known to be used in ransomware operations, successful exploitation can lead to data theft or encryption. Organizations can run a free exposure scan of their domains and email addresses against known breach data to determine whether related credentials or messages have already appeared in public datasets.