SmarterTools patches critical SmarterMail flaw allowing code execution

SmarterTools fixed two SmarterMail flaws, including a critical bug (CVE-2026-24423) that could allow arbitrary code execution.

SmarterTools fixed two security bugs in its SmarterMail email software, including a critical vulnerability, tracked as CVE-2026-24423 (CVSS score of 9.3) that could let attackers run malicious code on affected systems.

“SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method.” reads the advisory. “The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.”

The researchers Sina Kheirkhah & Piotr Bazydlo of watchTowr, Markus Wulftange of CODE WHITE GmbH, and Cale Black of VulnCheck reported the vulnerability.

SmarterTools addressed the issue in version Build 9511.

SmarterTools also addressed the critical vulnerability CVE-2026-23760 (CVSS score: 9.3), which is actively exploited in the wild. An unauthenticated attacker can exploit the flaw to hijack administrator accounts and achieve remote code execution on the target, potentially leading to a full takeover of vulnerable servers.

This week, nonprofit security organization Shadowserver reported that over 6,000 SmarterMail servers are exposed on the internet and likely vulnerable to attacks exploiting CVE-2026-23760. Cybersecurity firm watchTowr disclosed the vulnerability on January 8, and SmarterTools addressed it on January 15, without assigning a CVE.

“SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts.” reads the advisory. “An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.”

watchTowr researchers released a proof-of-concept exploit that only needs the admin username.

Shadowserver reported that over 6,000 SmarterMail servers are likely vulnerable, based on their version check. The researchers also observed exploitation attempts in attacks in the wild.

This week, CISA added CVE-2026-23760 to its KeV catalog, ordering FCEB agencies to address the identified vulnerability by February 16, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-24423)