VulnerabilitycriticalExploited in the wild

SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score

The Hacker Newsby @TheHackersNewsFeb 6, 2026 · 09:36 UTC (Feb 6, 2026)3 min read3 · 1 read

Read at thehackernews.com

Analyze CVE-2026-24423 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-24423 CVE-2026-23760 CVE-2026-25067

Tags: cve-2026-24423 cve-2026-23760 cve-2026-25067 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-23760	Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail	9.3	96%	KEVRansomwarePoC ×2	Jan 22, 2026 KEV Jan 26, 2026
CVE-2026-24423	Unauthenticated RCE in SmarterTools SmarterMail (CVE-2026-24423)	9.3	88%	KEVRansomwarePoC	Jan 23, 2026 KEV Feb 5, 2026
CVE-2026-25067	SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint	6.9	<1%		Jan 29, 2026

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Jan 30, 2026 Vulnerability / Email Security SmarterTools has addressed two more security flaws in SmarterMail email software, including one critical security flaw that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-24423 , carries a CVSS score of 9. 3 out of 10.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.