{"id":"smartermail-connecttohub-rce-feb-2026","category":"patch","status":"closed","title":"SmarterTools SmarterMail ConnectToHub flaw CVE-2026-24423 lets attackers run code without login; used by ransomware gangs","tldr":"SmarterMail email servers before build 9511 have a no-login remote code flaw (CVE-2026-24423) that ransomware gangs have used, including against SmarterTools itself. Fixed in 9511 and later. Anyone running their own SmarterMail should update to the latest build.","summary":"CVE-2026-24423 is a flaw in SmarterMail, the email and collaboration server from SmarterTools. A management function called ConnectToHub does not check who is calling it. An attacker on the internet can use it to point a SmarterMail server at a hostile web server, which feeds back an operating-system command that the mail server then runs. No password is needed. It is rated critical, CVSS 9.8 in the US National Vulnerability Database. It affects builds before 100.0.9511. SmarterTools released build 9511 on 15 January 2026, and later builds have kept shipping security fixes, with 9777 the newest in the release notes we read. CISA added the flaw to its list of vulnerabilities being used in attacks on 5 February 2026 and marked it as used in ransomware. Help Net Security reported on 9 February that SmarterTools itself was breached by the Storm-2603 ransomware group through this flaw. Mostly a business problem: it matters to organisations or families who run their own SmarterMail server. People who only use a hosted mailbox have nothing to install.","action":"If you or your IT provider run SmarterMail yourselves, update to the latest build now (at minimum 100.0.9511) and check the server for signs of compromise. If your email is hosted by someone else, ask them whether they have updated.","product":"SmarterTools SmarterMail email server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-24423"],"tags":["smartermail","smartertools","email-server","remote-code-execution","ransomware","cisa-kev","no-login"],"affected":["SmarterTools SmarterMail before build 100.0.9511"],"fixed":["100.0.9511"],"matches":[],"sources":[{"kind":"advisory","title":"SmarterMail release notes (current)","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","date":"2026-10-08"},{"kind":"news","title":"Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","date":"2026-02-09"}],"started":"2026-02-05","closed":"2026-02-13","created":"2026-11-03T22:03:16.114Z","updated":"2026-11-03T22:03:16.114Z","cve_notes":[{"cve":"CVE-2026-24423","name":"Missing authentication in SmarterMail ConnectToHub API","what":"The ConnectToHub management function in SmarterMail needs no login, so an attacker can point the server at a malicious web server that returns an operating-system command, which the mail server then runs.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-02-13","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"SmarterMail build 9540 changed command-line handling (marked important) and fixed further security issues. Release notes through build 9777 (8 October 2026) continue to list security fixes, so the current build includes the 9511 fix.","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","patch":"patched"},{"at":"2026-02-09","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Help Net Security added an update saying SmarterTools itself was breached by the ransomware group Storm-2603 through this vulnerability.","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","patch":null},{"at":"2026-02-06","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Help Net Security reported this as the third SmarterMail flaw added to CISA's list in two weeks, after CVE-2025-52691 and CVE-2026-23760. It said the flaw was independently reported by watchTowr, CODE WHITE and VulnCheck, and affects versions before 100.0.9511.","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","patch":null},{"at":"2026-02-05","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-24423, an unauthenticated remote code execution flaw in SmarterMail's ConnectToHub API, to its Known Exploited Vulnerabilities list and marked it as used in ransomware attacks. Federal agencies were given until 26 February 2026 to fix it.","url":"https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/","by":"Help Net Security","patch":null},{"at":"2026-01-15","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"SmarterTools released SmarterMail build 9511, flagged in its release notes as an important update with critical security fixes. The notes do not name CVE-2026-24423 in the entry; CISA and press reports later gave 9511 as the first fixed build.","url":"https://www.smartertools.com/smartermail/release-notes/current","by":"SmarterTools","patch":"patched"}],"url":"https://hard.fyi/live/smartermail-connecttohub-rce-feb-2026/","json":"https://hard.fyi/api/live?id=smartermail-connecttohub-rce-feb-2026"}