CVE-2026-24423 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-24423CRITICAL

SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .8769   99.7   YES

AFFECTED
  Product      Versions     Fixed
  SmarterMail  unspecified  —

TIMELINE
  Jan 22  Reserved by VulnCheck
  Feb 5   Added to CISA KEV, remediation due 2026-02-26
  Feb 5   Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed · KEV due February 26, 2026

Description

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 22, 2026	Reserved	Reserved by VulnCheck
February 5, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-02-26
February 5, 2026	Published	Published (CNA: VulnCheck)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
SmarterTools	SmarterMail	—	—	—

Weaknesses

CWE-306

References (4)

https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail [Third Party Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423 [US Government Resource]
https://www.smartertools.com/smartermail/release-notes/current [Release Notes]
https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api [Third Party Advisory]

Authoritative record: CVE-2026-24423 at cve.org

Vendors: smartertools

Weaknesses: CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24423 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.