CVE-2026-24423

What it actually does

The vulnerability is an unauthenticated remote code execution flaw in the ConnectToHub API method. A remote attacker can cause the vulnerable application to connect to an attacker-controlled HTTP server and consume a response that contains an operating-system command, which the application then executes with the privileges of the SmarterMail service process. Because no authentication, user interaction, or prior access is required, successful exploitation can provide full application-level and potentially host-level compromise, including command execution, data access, persistence, lateral movement, and service disruption.

Why it matters to the business

This is a critical internet-exposed mail-server risk with active exploitation, high EPSS likelihood, and CISA KEV listing, including reported ransomware use. Compromise can lead to email service outage, theft of mailbox data and credentials, attacker access to internal communications, malware deployment, and broader network intrusion from a trusted messaging server. Organizations subject to CISA KEV requirements should remediate by 2026-02-26, and all organizations should treat exposed systems as urgent because the issue has been public for 199 days and is being exploited in the wild.

How an attack unfolds

An attacker identifies a vulnerable SmarterMail deployment reachable over the network and sends a crafted unauthenticated request to the ConnectToHub API method. The request causes the server to initiate an outbound HTTP connection to attacker-controlled infrastructure. That malicious server returns data containing an operating-system command, which the vulnerable application executes locally. After initial command execution, the attacker commonly validates execution, downloads tooling or web shells, creates persistence, dumps credentials or mailbox data, disables defenses, and may deploy ransomware or use the compromised mail server as a foothold for lateral movement. The threat context indicates exploitation is active in the wild and associated with ransomware activity, so post-exploitation activity should be assumed if exposure existed before remediation.

How to fix it

Upgrade SmarterTools SmarterMail to build 9511 or later immediately. If immediate upgrade is not possible, restrict public access to the affected API surface, place the service behind a VPN or allowlisted reverse proxy, block unauthenticated access to ConnectToHub-related routes where feasible, and restrict outbound HTTP/HTTPS from the mail server to only approved destinations. Monitor for suspicious child processes spawned by the mail service and rotate credentials stored or used by the mail platform after patching. The supplied package metadata also lists zauberzeug/nicegui fixed at commit 6502fb37bc1cb39752f4e75c12b608078939cc73; validate product applicability in inventory and update any affected NiceGUI deployments to that commit or a later release containing it. Because the vulnerability is in KEV and associated with ransomware, patching should be paired with compromise assessment rather than treated as a routine upgrade.

How to confirm the fix worked

Confirm the installed SmarterMail build is 9511 or later from the administrative interface, vendor version output, package manifest, or file metadata. Validate that unauthenticated requests to the ConnectToHub API method are rejected or no longer trigger outbound connections to arbitrary URLs. From a controlled test network, verify the server cannot be made to contact untrusted HTTP endpoints through the vulnerable method. Review firewall or proxy policy to ensure the mail server cannot initiate arbitrary outbound HTTP/HTTPS except to approved update, relay, and integration endpoints. For the supplied NiceGUI package metadata, confirm the deployed source includes commit 6502fb37bc1cb39752f4e75c12b608078939cc73 or a later fixed revision if that package is actually in scope.

Typical attack path

1. Scan the internet or target ranges for exposed SmarterMail services and identify versions prior to the fixed build.
2. Send an unauthenticated crafted request to the ConnectToHub API method that points the application to attacker-controlled HTTP infrastructure.
3. Serve a malicious response containing an operating-system command from the attacker-controlled HTTP server.
4. Trigger command execution in the vulnerable application context on the mail server.
5. Run discovery commands, confirm privileges, and stage additional payloads using built-in tools such as PowerShell, certutil, curl, or bitsadmin.
6. Establish persistence, access mailbox or configuration data, harvest credentials, and attempt lateral movement.
7. Deploy ransomware, exfiltrate data, or disrupt mail operations.

How to detect it

Investigate web and application logs for unauthenticated requests referencing ConnectToHub, especially requests followed by outbound HTTP/HTTPS connections to unfamiliar hosts. Correlate proxy, DNS, firewall, and NetFlow records for unexpected outbound traffic originating from the mail server around the time of those requests. Review EDR and Windows process-creation telemetry for command interpreters or living-off-the-land tools launched by the SmarterMail service process, including cmd.exe, powershell.exe, certutil.exe, curl.exe, bitsadmin.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, and encoded PowerShell. Examine Windows Security Event ID 4688, Sysmon Event ID 1, PowerShell logs 4103/4104, service creation events 7045, scheduled task creation, new local users, registry Run keys, and unusual files in web, temp, program data, and mail application directories. Search mail application logs for ConnectToHub errors, hub connection attempts, unexpected URL values, or outbound callback failures. Because ransomware activity is reported, also hunt for mass file modifications, shadow copy deletion, security tool tampering, archive creation, and outbound transfers to unknown infrastructure. Absence of a single indicator does not rule out compromise; prioritize behavioral correlation between ConnectToHub access, outbound callbacks, and child process execution.

• ConnectToHub
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• curl.exe http://
• wget.exe http://
• mshta.exe http://
• rundll32.exe javascript:
• regsvr32.exe /s /n /u /i:http
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no
• wevtutil.exe cl Security
• wevtutil.exe cl System
• schtasks.exe /Create
• sc.exe create
• net user /add
• net localgroup administrators
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• Event ID 4688
• Event ID 7045
• Sysmon Event ID 1
• PowerShell Event ID 4104

What your security team should do

• Immediately identify all internet-facing SmarterMail systems and prioritize those running builds prior to 9511.
• Upgrade SmarterMail to build 9511 or later; for any applicable zauberzeug/nicegui deployment, update to commit 6502fb37bc1cb39752f4e75c12b608078939cc73 or later.
• If patching cannot be completed immediately, restrict inbound access to the mail administration/API surface and block arbitrary outbound HTTP/HTTPS from the mail server.
• Treat previously exposed vulnerable systems as potentially compromised and begin incident-response triage before or immediately after patching.
• Hunt for unauthenticated ConnectToHub activity, unexpected outbound HTTP requests from the mail server, and command-shell or scripting interpreters spawned by the mail service.
• Rotate administrative, service, mailbox, and integration credentials that may have been accessible from the mail server.
• Review EDR, web, proxy, firewall, Windows Event Logs, and mail application logs for ransomware staging, credential dumping, suspicious archive creation, and data exfiltration.
• Ensure backups for mail data and server configuration are offline or immutable and verify restoration procedures due to ransomware association.
• Meet the CISA KEV remediation deadline of 2026-02-26 where applicable, but remediate sooner because exploitation is active and EPSS is high.