CVE-2026-24423
Missing Authentication for Critical Function in SmarterTools SmarterMail. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 5 February 2026.
- Product
- SmarterTools SmarterMail
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- Known to be used in ransomware
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
More from SmarterTools this year.
- CVE-2026-23760 Authentication Bypass Using an Alternate Path or Channel, added
- CVE-2025-52691 Unrestricted Upload of File with Dangerous Type, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 3 November 2026.