Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)

SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr.

Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines.

SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress.

Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments.

SmarterTools SmarterMail builds prior to build 9511 fail to require authentication on the ConnectToHub API method (CWE-306, Missing Authentication for Critical Function), resulting in unauthenticated remote code execution. An attacker triggers the flaw by directing SmarterMail to connect to an attacker-controlled HTTP server, which serves a malicious OS command that the vulnerable application then executes on the host. Successful exploitation yields arbitrary command execution on the mail server, enough for full system compromise and serving as the initial-access vector for the Warlock ransomware group. Any organization running an affected SmarterMail build is exposed, particularly those with the server's web/API interface reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05 with known ransomware use, and EPSS assigns an 87.7% probability of exploitation within 30 days (100th percentile).

Do: Upgrade SmarterMail to build 9511 or later as soon as possible, prioritizing internet-facing mail servers. If patching cannot be done immediately, restrict internet access to the SmarterMail web/API interface and monitor the host for signs of compromise given confirmed ransomware exploitation. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing.