SmarterTools SmarterMail ConnectToHub flaw CVE-2026-24423 lets attackers run code without login; used by ransomware gangs
SmarterMail email servers before build 9511 have a no-login remote code flaw (CVE-2026-24423) that ransomware gangs have used, including against SmarterTools itself. Fixed in 9511 and later. Anyone running their own SmarterMail should update to the latest build.
If you or your IT provider run SmarterMail yourselves, update to the latest build now (at minimum 100.0.9511) and check the server for signs of compromise. If your email is hosted by someone else, ask them whether they have updated.
What’s happening
CVE-2026-24423 is a flaw in SmarterMail, the email and collaboration server from SmarterTools. A management function called ConnectToHub does not check who is calling it. An attacker on the internet can use it to point a SmarterMail server at a hostile web server, which feeds back an operating-system command that the mail server then runs. No password is needed. It is rated critical, CVSS 9.8 in the US National Vulnerability Database. It affects builds before 100.0.9511. SmarterTools released build 9511 on 15 January 2026, and later builds have kept shipping security fixes, with 9777 the newest in the release notes we read. CISA added the flaw to its list of vulnerabilities being used in attacks on 5 February 2026 and marked it as used in ransomware. Help Net Security reported on 9 February that SmarterTools itself was breached by the Storm-2603 ransomware group through this flaw. Mostly a business problem: it matters to organisations or families who run their own SmarterMail server. People who only use a hosted mailbox have nothing to install.
- What
- Flaw
- Affects
- SmarterTools SmarterMail email server
- Affected
- SmarterTools SmarterMail before build 100.0.9511
- Fixed in
- 100.0.9511
- Since
- 5 Feb 2026
- Closed
- 13 Feb 2026
Timeline
- New fixFixed
SmarterMail build 9540 changed command-line handling (marked important) and fixed further security issues. Release notes through build 9777 (8 October 2026) continue to list security fixes, so the current build includes the 9511 fix.
- Wider attacks
Help Net Security added an update saying SmarterTools itself was breached by the ransomware group Storm-2603 through this vulnerability.
- Update
Help Net Security reported this as the third SmarterMail flaw added to CISA's list in two weeks, after CVE-2025-52691 and CVE-2026-23760. It said the flaw was independently reported by watchTowr, CODE WHITE and VulnCheck, and affects versions before 100.0.9511.
- CISA added
CISA added CVE-2026-24423, an unauthenticated remote code execution flaw in SmarterMail's ConnectToHub API, to its Known Exploited Vulnerabilities list and marked it as used in ransomware attacks. Federal agencies were given until 26 February 2026 to fix it.
- New fixFixed
SmarterTools released SmarterMail build 9511, flagged in its release notes as an important update with critical security fixes. The notes do not name CVE-2026-24423 in the entry; CISA and press reports later gave 9511 as the first fixed build.
Sources
- SmarterMail release notes (current)SmarterTools · 8 Oct 2026
- Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)Help Net Security · 9 Feb 2026