Cloud Security

SmarterMail RCE CVE-2026-24423: Why Your Mail Host Is Next

July 5, 2026 · 8 min read · By CloudAI Security

SmarterTools SmarterMail, a self-hosted enterprise mail and collaboration platform widely deployed by managed service providers, carries a critical unauthenticated remote code execution flaw tracked as CVE-2026-24423 (CVSS v4.0 9.3). The bug lives in the administrative ConnectToHub API, lets any network attacker run operating-system commands with service privileges, and remains actively exploited by the Warlock (Storm-2603) ransomware group. CISA added it to the Known Exploited Vulnerabilities catalog on February 6, 2026, after the gang used it to breach SmarterTools itself.

Resumo / Key Points

What: CVE-2026-24423 is an unauthenticated RCE in SmarterMail’s ConnectToHub API (CWE-306, missing authentication for a critical function), patched in Build 9511 (January 23, 2026).
Who is exploiting it: Warlock ransomware, also tracked as Gold Salem and Storm-2603, a China-nexus operator that breached vendor SmarterTools on January 29, 2026 using a single unpatched employee VM.
Scope: Shadowserver flagged over 6,000 internet-exposed SmarterMail instances as likely vulnerable in January 2026; Macnica researcher Yutaka Sejiyama counted 8,550+ still-vulnerable hosts.
Action: Upgrade to SmarterMail Build 9518 or later immediately, isolate mail servers from the internal network, restrict outbound traffic to required mail protocols, and hunt for ConnectToHub and force-reset-password API anomalies.

The ConnectToHub RCE Mechanism

The flaw sits in functionality most administrators never think about. SmarterMail’s ConnectToHub API exists to let individual mail servers sync configuration with a centralized hub service used for cluster management. In vulnerable builds, the endpoint accepts an unauthenticated request carrying a hubAddress parameter that points the server at a hub of the attacker’s choosing, according to a technical analysis by CYFIRMA.

When SmarterMail dutifully connects to the malicious hub, it retrieves a JSON response containing parameters that internal routines interpret as operating-system commands. Because the application trusts the hub’s response without validation, the attacker-supplied payload executes inside the MailService.exe process. No credentials. No user interaction. No privileged position on the network required — just reach to the administrative port and fire.

The vulnerability maps to CWE-306 (Missing Authentication for Critical Function) and earned a CVSS v4.0 base score of 9.3 Critical. It is the kind of bug that should not ship in a 2026 product, and it is not alone: SmarterMail has now weathered three high-impact flaws in rapid succession — CVE-2025-52691 (CVSS 10.0), the CVE-2026-23760 password-reset authentication bypass, and CVE-2026-24423 itself, as documented by The Hacker News.

How Warlock Chained The Bugs

Ransomware operators rarely stop at a single flaw, and Storm-2603 treated SmarterMail as a toolkit rather than a single hole. The chained path documented by ReliaQuest and reported by SC Media runs as follows:

Auth bypass via CVE-2026-23760: The force-reset-password endpoint fails to verify the old password or a reset token when resetting system administrator accounts. Supply a username and a new password, and you own the instance.
Privilege escalation through “Volume Mount”: The Volume Mount feature, intended for mounting network drives, accepts arbitrary commands because it trusts the now-compromised administrator role.
Payload staging on Supabase: The MailService.exe process spawns a shell that pulls v4.msi from Supabase, a legitimate cloud backend the group adopted after GitHub-hosted payloads drew attention.
Persistence via Velociraptor: The MSI installs Velociraptor, the open-source DFIR tool, reconfigured as a command-and-control backdoor — a trademark Storm-2603 move that blends into legitimate admin telemetry.

The vendetta turned self-referential in late January. On January 29, 2026, Warlock breached SmarterTools’ own network by exploiting an unpatched SmarterMail VM that an employee had spun up and forgotten, Chief Commercial Officer Derek Curtis confirmed. Of roughly 30 SmarterMail installations across the company, that single unmaintained box was the foothold. Attackers reached Active Directory, hit 12 Windows servers on the office network plus a secondary data center, and waited six to seven days before attempting to deploy the encryptor. SentinelOne caught the payload before encryption, and segmentation kept the customer portal and shopping cart intact — but the lesson was printed in headlines anyway.

Thousands Of Servers Still Exposed

The patch has been available since January, yet the exposure problem has not collapsed. Shadowserver’s January 2026 scan flagged over 6,000 internet-facing SmarterMail servers as likely vulnerable, with more than 4,200 concentrated in North America and nearly 1,000 in Asia, BleepingComputer reported. Independent scans by Macnica researcher Yutaka Sejiyama returned 8,550+ vulnerable instances for CVE-2026-23760 alone.

SmarterMail Flaw	Type	CVSS	Status
CVE-2025-52691	Pre-auth RCE	10.0	KEV, exploited in the wild
CVE-2026-23760	Auth bypass (password reset API)	9.3	KEV, CISA deadline Feb 16, 2026
CVE-2026-24423	Unauth RCE (ConnectToHub API)	9.3	KEV, feeds ransomware campaigns

Five public proof-of-concept exploits are circulating on GitHub for CVE-2026-24423, lowering the bar from skilled attacker to script kiddie. Once a PoC exists, the dwell-time-to-encryption curve flattens. The fact that two separate threat-actor clusters left ConnectToHub and force-reset-password artifacts on the same compromised instance, as ReliaQuest observed, confirms multiple groups are independently scanning and exploiting the same surface.

Why SmarterMail Keeps Getting Hit

Self-hosted mail is structurally exposed. A mail server must accept inbound connections from the entire internet by design, which means the administrative plane lives one port away from the public attack surface. SmarterMail compounds this with two design choices that have aged badly: a hub-sync API that accepts unauthenticated remote instructions, and a Volume Mount feature that trusts the administrator shell with no command allowlist.

Deployment patterns make things worse. SmarterMail is popular with hosting providers and MSPs running multi-tenant mail at scale, which means a single compromise can cascade across customer estates. The SmarterTools breach itself demonstrated the shadow-IT problem: even the vendor could not maintain a complete inventory of its own mail servers. If a 30-instance deployment hides a forgotten VM, imagine a 300-tenant hosting provider with per-customer spin-ups.

For broader context on why mail and adjacent infrastructure are perennial targets, the parallel break in Gravity SMTP CVE-2026-4020 leaking cloud email keys and the abuse of remote management tooling covered in SimpleHelp RMM CVE-2026-48558 show the same adversary playbook: find the internet-facing admin plane, hijack it, weaponize the legitimate tooling underneath.

The Operational Playbook For Defenders

If you run SmarterMail — or support tenants who do — treat this as an active incident, not a patch ticket. The following sequence closes the hole and catches the dwell activity that precedes encryption:

Inventory first. Find every SmarterMail instance under your responsibility, including test, lab, and employee-spun-up VMs. The SmarterTools breach proved that shadow deployments are the breach vector. Query AD and your asset DB for the SmarterMail service account and MailService.exe.
Patch to Build 9518 or later. Build 9511 fixed CVE-2026-24423, but later builds harden the auth flow. Treat anything older as compromised until proven otherwise.
Isolate the mail tier. Segment SmarterMail servers from domain controllers, file shares, and the rest of the internal network. Restrict outbound mail-server traffic to required SMTP/IMAP/HTTPS destinations — the ConnectToHub exploit needs outbound reach to the attacker hub.
Hunt the two telltale APIs. Search web and MailService logs for requests to force-reset-password and ConnectToHub endpoints, especially from unfamiliar source IPs. Anomalous ConnectToHub calls from infrastructure that is not your real hub are a near-certain exploitation indicator.
Hunt for Velociraptor. Legitimate DFIR tooling installed outside an authorized incident-response engagement is a red flag. Look for Velociraptor binaries, MSI installs referencing v4.msi, and Supabase-hosted download traffic.
Validate credentials. If any ConnectToHub or password-reset anomaly is found, assume the mail server’s stored credentials — SMTP relays, AD service accounts, tenant auth — are burned and rotate them.
Close the KEV loop. Both CVE-2026-23760 and CVE-2026-24423 are in CISA’s Known Exploited Vulnerabilities catalog. Federal agencies had until February 16, 2026 to remediate; private operators should hold themselves to the same standard given active ransomware monetization.

The wider ransomware trend is accelerating in severity, not just volume. The emergence of agentic ransomware like JADEPUFFER shows operators layering automation and LLMs on top of familiar initial-access vectors. SmarterMail’s unauthenticated admin APIs are exactly the kind of predictable, internet-reachable foothold those automated chains are tuned to find.

The Takeaway

CVE-2026-24423 is not a legacy bug in a forgotten product. It is a 2026-vintage unauthenticated RCE in actively exploited, internet-facing mail infrastructure, with five public PoCs and a ransomware operator that has already proved the kill chain end to end — including against the vendor. Six months after the patch shipped, thousands of instances remain reachable. The defenders who treat SmarterMail as critical infrastructure and inventory every instance will keep their tenants off the next breach disclosure. The ones who assume someone else patched it will not.