/Vulnerability Library

SmarterMail - Remote Code Execution

CVE-2026-24423
Verified

Description

SmarterTools SmarterMail < build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

88%

Published Date

April 10, 2026

Template Author

jyoti369

CVE-2026-24423.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-24423
CWE ID:
cwe-306

References

https://www.vulncheck.com/blog/smartermail-connecttohub-rce-cve-2026-24423https://code-white.com/public-vulnerability-list/https://www.smartertools.com/smartermail/release-notes/currenthttps://nvd.nist.gov/vuln/detail/CVE-2026-24423

Remediation Steps

Update to build 9511 or later.