2026-02-05 — SmarterMail missing auth in ConnectToHub API → command execution chain (CVE-2026-24423) (CISA KEV)¶

CISA added CVE-2026-24423 to the Known Exploited Vulnerabilities catalog.

• KEV entry (JSON feed): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Summary¶

SmarterMail has a missing authentication issue in the ConnectToHub API method. Per KEV, an attacker can point the instance to a malicious HTTP server that serves a malicious OS command, potentially leading to command execution.

Triage¶

• Identify all SmarterMail instances (especially internet-exposed).
• Confirm installed version against vendor release notes.
• Review logs for unexpected outbound HTTP connections / hub configuration changes.

Mitigation¶

• Apply vendor updates/mitigations immediately (see SmarterMail release notes).
• If patching is delayed:
• restrict access to admin/API surfaces to trusted IPs
• block unexpected outbound HTTP from the mail server (egress filtering)
• monitor for process execution anomalies

Detection / hunt¶

• Hunt for:
• outbound HTTP to unknown hosts
• new/modified SmarterMail configs
• suspicious child processes spawned by SmarterMail