SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-23760 | Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress. Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments. | 9.3 | 96% | KEV ransomware PoC ×2 |
| moderate≈6,000+ internet-exposed SmarterMail servers | |
| CVE-2026-24423 | Unauthenticated RCE in SmarterTools SmarterMail (CVE-2026-24423) SmarterTools SmarterMail builds prior to build 9511 fail to require authentication on the ConnectToHub API method (CWE-306, Missing Authentication for Critical Function), resulting in unauthenticated remote code execution. An attacker triggers the flaw by directing SmarterMail to connect to an attacker-controlled HTTP server, which serves a malicious OS command that the vulnerable application then executes on the host. Successful exploitation yields arbitrary command execution on the mail server, enough for full system compromise and serving as the initial-access vector for the Warlock ransomware group. Any organization running an affected SmarterMail build is exposed, particularly those with the server's web/API interface reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05 with known ransomware use, and EPSS assigns an 87.7% probability of exploitation within 30 days (100th percentile). Do: Upgrade SmarterMail to build 9511 or later as soon as possible, prioritizing internet-facing mail servers. If patching cannot be done immediately, restrict internet access to the SmarterMail web/API interface and monitor the host for signs of compromise given confirmed ransomware exploitation. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing. | 9.3 | 88% | KEV ransomware |
| largeon the order of tens of thousands of deployed SmarterMail servers (10k-100k installations) | |
| CVE-2026-25067 | SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication. NVD description · AI analysis pending | 6.9 | <1% |
| — |
Full article588 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 30, 2026Vulnerability / Email Security
SmarterTools has addressed two more security flaws in SmarterMail email software, including one critical security flaw that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-24423, carries a CVSS score of 9.3 out of 10.0.
"SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method," according to a description of the flaw in CVE.org.
"The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS [operating system] command. This command will be executed by the vulnerable application."
watchTowr researchers Sina Kheirkhah and Piotr Bazydlo, CODE WHITE GmbH's Markus Wulftange, and VulnCheck's Cale Black have been credited with discovering and reporting the vulnerability.
The security hole has been addressed in version Build 9511, released on January 15, 2026. The same build also patches another critical flaw (CVE-2026-23760, CVSS score: 9.3) that has since come under active exploitation in the wild.
In addition, SmarterTools has shipped fixes to plug a medium-severity security vulnerability (CVE-2026-25067, CVSS score: 6.9) that could allow an attacker to facilitate NTLM relay attacks and unauthorized network authentication.
It has been described as a case of unauthenticated path coercion affecting the background-of-the-day preview endpoint.
"The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation," VulnCheck noted in an alert.
"On Windows systems, this allows UNC [Universal Naming Convention] paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication."
The vulnerability has been patched in Build 9518, released on January 22, 2026. With two vulnerabilities in SmarterMail coming under active exploitation over the past week, it's essential that users update to the latest version as soon as possible.
Flaw Exploited in Ransomware Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on February 5, 2026, added CVE-2026-24423 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by February 26, 2026.
While there appear to have been no public reports on the exploitation of the vulnerable, CISA confirmed that it's being weaponized in ransomware campaigns.
"The SmarterTools SmarterMail server prior to version 100.0.9511 is vulnerable to an unauthenticated remote code execution using the ConnectToHub API," VulnCheck said. "The vulnerable API endpoint (/api/v1/settings/sysadmin/connect-to-hub) does not require authentication and configures the mounted path of the server."
The root cause, the cybersecurity company added, is that the "connect-to-hub" API endpoint defined in "MailService.dll" explicitly allows anonymous users and processes JSON data sent in POST requests, effectively allowing an attacker to define a malicious "CommandMount" parameter in the JSON object that contains an arbitrary command to be executed.
This, in turn, is possible because the endpoint processes remote addresses specified in the "hubAddress" parameter within the POST request, which points to an attacker-controlled server.
"Defenders should immediately monitor and check logs for interactions with the '/api/v1/settings/sysadmin/connect-to-hub' endpoint, which in patched versions will not respond with a HTTP 400 status code and error message in the current build (9511)," Black said.
"A version number can also be retrieved unauthenticated via the '/api/v1/licensing/about endpoint' that can be used for quick validation."
(The story was updated after publication on February 6, 2026, to include details of CISA's alert.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/smartermail-fixes-critical.html