SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API (CVE-2026-24423)

What is affected, what to do

The vulnerability CVE-2026-24423 allows for remote code execution (RCE) in SmarterTools SmarterMail versions prior to 100.0.9511 due to missing authentication in the ConnectToHub API method. An attacker can redirect the SmarterMail instance to a malicious HTTP server that executes harmful OS commands. This vulnerability is actively exploited in ransomware campaigns since 2026. All versions before build 9511 are affected. It is imperative to update to version 100.0.9511 or higher to mitigate this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update SmarterTools SmarterMail to version 100.0.9511. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SmarterTools SmarterMail lt *..100.0.9511

Fixed in

• SmarterTools SmarterMail 100.0.9511

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Upgrade SmarterMail to build 9511 or later. All builds prior to 9511 are vulnerable. Check the SmarterTools vendor advisory for the current build and install the latest available release, not just the minimum fixed one.
   • Cut exposure immediately: Until the patch is in place, block internet access to the web/API interface (HTTP/HTTPS or your custom web port) at the perimeter, or restrict it to VPN and admin source ranges. SMTP, IMAP and POP3 can stay open because the flaw is in the API.
   • Check for compromise before patching: Preserve and review the web/IIS logs of every SmarterMail instance for requests containing ConnectToHub. Treat any hit as a compromise: isolate the host, take a forensic image, then patch or rebuild.
   • Lock down server egress: Restrict outbound HTTP/HTTPS from the SmarterMail host to known destinations such as update, licensing and spam/AV feed servers. The exploit depends on the server reaching an attacker-controlled HTTP server.
   • Rotate credentials (if suspicious): Reset passwords for SmarterMail system and domain admins and the service account, plus any credentials stored on the box (AD/LDAP bind accounts, SMTP relay credentials).
   • Trigger reporting: If compromise is confirmed, start the NIS2 notification clock (early warning to the competent authority within 24 h). Because CISA flags known ransomware use, engage your IR team early.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Host SmarterMail in a DMZ with tight egress filtering. Allow no direct reach from the mail server to internal file servers, domain controllers (beyond the LDAP/Kerberos ports it needs) or backup infrastructure, to slow lateral movement and ransomware spread.
   • WAF/reverse proxy: Block requests whose URI or body contains ConnectToHub (case-insensitive) from untrusted networks. If you don't use hub/cluster functionality, drop the call entirely. Also put admin and API paths behind an IP allowlist.
   • IPS rule: Deploy a custom Suricata/Snort signature that matches HTTP requests to the SmarterMail host with content ConnectToHub (nocase) in http.uri or http.request_body, set to drop for external sources. Enable vendor IPS signatures for CVE-2026-24423 where they exist.
   • Endpoint hardening: Use an EDR policy, AppLocker or WDAC to block cmd.exe, powershell.exe, pwsh.exe, mshta.exe, rundll32.exe, certutil.exe and bitsadmin.exe from spawning under the SmarterMail service or w3wp.exe. At minimum, run Attack Surface Reduction rules in block mode.
   • Least privilege: Avoid running the SmarterMail service as LocalSystem where the vendor supports this. Use a dedicated service account with minimal filesystem and network rights to limit the blast radius of code execution.
   • Backup protection: Take offline or immutable copies of mail stores and configuration. Verify you can restore them before you patch or rebuild.
3. 03

   Runbook step 3

   Detection rules

   • Web/IIS access logs: Look for requests with ConnectToHub in the path, especially from external IPs, without a prior authenticated session or with an unusual user agent. SPL: index=web host=<smartermail> "ConnectToHub" | stats count by src_ip, uri, status
   • EDR/Sysmon EID 1 (process creation): Look for shell or LOLBin children of the SmarterMail service or w3wp.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("MailService.exe","w3wp.exe") and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","rundll32.exe","mshta.exe"). Verify the service binary name against your own installation first.
   • Network telemetry (Zeek/Suricata, Sysmon EID 3): Look for outbound HTTP/HTTPS from the mail server to previously unseen or newly registered destinations immediately after an inbound ConnectToHub request. That inbound-then-outbound pairing is a strong exploitation signal.
   • Persistence and ransomware staging: Monitor Windows Event IDs 4698 (scheduled task), 7045 (new service) and 4720/4732 (new account or group change), plus Sysmon EID 11 for new .aspx/.exe/.dll files in web or SmarterMail directories. Also alert on vssadmin delete shadows or wbadmin on the mail host.
   • Sigma shape: logsource: product=windows, category=process_creation · selection: ParentImage|endswith: ['\MailService.exe','\w3wp.exe'] and Image|endswith: ['\cmd.exe','\powershell.exe'] · level: high

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE), pwn.watch

Vendors and products

• SmarterTools SmarterTools SmarterMail

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• smartertools.comSmarterTools SmarterMail — CVE-2026-24423Release notes, Patch, pwn-watch
• code-white.compublic-vulnerability-listThird-party advisory
• vulncheck.comadvisories/smartertools-smartermail-unauthenticated-rce-via-con…Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423government-resource
• pwn.watchpwn.watch: SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-24423pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch