U.S. CISA adds SmarterTools SmarterMail and React Native Community CLI flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11953 | Unauthenticated OS Command Injection in React Native Community CLI (Metro4Shell) The Metro development server launched by the React Native Community CLI binds to external network interfaces by default and exposes an endpoint vulnerable to operating system command injection (CWE-78). An unauthenticated attacker with network reachability to the dev server can trigger the flaw by sending a crafted POST request to that endpoint. Successful exploitation lets the attacker run arbitrary executables on the host, and on Windows the attacker can execute arbitrary shell commands with fully controlled arguments, effectively achieving full remote code execution on the developer machine. Anyone running the Metro dev server via the community CLI where its port is reachable from an untrusted network, such as shared office, campus, or cloud development environments, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-02-05, carries a 94% EPSS score, and attackers reportedly used it to deploy Rust malware before public disclosure. Do: Upgrade the React Native Community CLI to the latest patched release per the vendor advisory (fixed versions are not specified in the source data). As interim mitigation, run the Metro dev server bound to localhost only or firewall its port from untrusted networks, and stop leaving dev servers running on externally reachable interfaces. Because exploitation predates public disclosure, review Windows developer machines for signs of compromise, including unexpected executables or Rust-based malware, per the JFrog and VulnCheck analyses. | 9.8 | 94% | KEV PoC ×2 |
| massmillions of developer environments potentially exposed (headline reporting puts exposed developers in the millions); the count of actually internet-exposed dev… | |
| CVE-2026-24423 | Unauthenticated RCE in SmarterTools SmarterMail (CVE-2026-24423) SmarterTools SmarterMail builds prior to build 9511 fail to require authentication on the ConnectToHub API method (CWE-306, Missing Authentication for Critical Function), resulting in unauthenticated remote code execution. An attacker triggers the flaw by directing SmarterMail to connect to an attacker-controlled HTTP server, which serves a malicious OS command that the vulnerable application then executes on the host. Successful exploitation yields arbitrary command execution on the mail server, enough for full system compromise and serving as the initial-access vector for the Warlock ransomware group. Any organization running an affected SmarterMail build is exposed, particularly those with the server's web/API interface reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05 with known ransomware use, and EPSS assigns an 87.7% probability of exploitation within 30 days (100th percentile). Do: Upgrade SmarterMail to build 9511 or later as soon as possible, prioritizing internet-facing mail servers. If patching cannot be done immediately, restrict internet access to the SmarterMail web/API interface and monitor the host for signs of compromise given confirmed ransomware exploitation. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing. | 9.3 | 88% | KEV ransomware |
| largeon the order of tens of thousands of deployed SmarterMail servers (10k-100k installations) |
Full article644 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 06, 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SmarterTools SmarterMail and React Native Community CLI flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SmarterTools SmarterMail and React Native Community CLI flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2025-11953 React Native Community CLI OS Command Injection Vulnerability
- CVE-2026-24423 SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
Attackers are actively exploiting a critical flaw in the React Native CLI Metro server, tracked as CVE-2025-11953. The React Native CLI’s Metro dev server binds to external interfaces by default and exposes a command injection flaw. Unauthenticated attackers can send POST requests to execute arbitrary programs, and on Windows can also run shell commands with fully controlled arguments.
“The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables.” reads the advisory. “On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.”
Metro is the JavaScript bundler and dev server used by React Native. By default, it can expose an endpoint that lets unauthenticated attackers run OS commands on Windows.
VulnCheck researchers observed consistent, real-world attacks weeks before broad disclosure.
VulnCheck spotted real-world exploitation of CVE-2025-11953 (Metro4Shell) on December 21, 2025, and again in January, showing attackers kept using it. Despite this, the activity still lacks broad public attention and carries a low EPSS score. The gap is risky, since the flaw is easy to exploit and many exposed servers remain online.
“Now, more than a month after initial exploitation in the wild, that activity has yet to see broad public acknowledgment, and EPSS continues to assign a low exploitation probability of 0.00405.” reads the advisory published by VulnCheck. “This gap between observed exploitation and wider recognition matters, particularly for vulnerabilities that are easy to exploit and, as internet-wide search data shows, exposed on the public internet.”
VulnCheck found active, sustained exploitation of CVE-2025-11953, showing it was used operationally rather than for testing. Attackers delivered a multi-stage, base64-encoded PowerShell loader via cmd.exe, disabled Microsoft Defender protections, fetched payloads over raw TCP, and executed a downloaded binary. The malware was a UPX-packed Rust payload with basic anti-analysis features.
The experts noted that attacks reused the same infrastructure and techniques for weeks. VulnCheck warns the lack of public acknowledgment risks leaving defenders unprepared, as exploitation often begins well before official recognition.
At the end of January, SmarterTools fixed two security bugs in its SmarterMail email software, including a critical vulnerability, tracked as CVE-2026-24423 (CVSS score of 9.3) that could let attackers run malicious code on affected systems.
“SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method.” reads the advisory. “The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.”
The researchers Sina Kheirkhah & Piotr Bazydlo of watchTowr, Markus Wulftange of CODE WHITE GmbH, and Cale Black of VulnCheck reported the vulnerability.
SmarterTools addressed the issue in version Build 9511.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by February 26, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/187675/security/u-s-cisa-adds-smartertools-smartermail-and-react-native-community-cli-flaws-to-its-known-exploited-vulnerabilities-catalog.html