Summary:
Watchtowr Labs researchers identified a series of critical vulnerabilities in SmarterTools' SmarterMail email and collaboration server, most notably CVE-2026-24423 and an authentication bypass (tracked by watchTowr as WT-2026-0001). These flaws allow unauthenticated attackers to bypass security controls, reset administrative passwords, and achieve Remote Code Execution (RCE) with system-level privileges. Specifically, CVE-2026-24423 involves a missing authentication check in the ConnectToHub API, enabling attackers to execute arbitrary commands by directing the server to a malicious mount point. Simultaneously, WT-2026-0001 (often associated with CVE-2026-23760) allows attackers to force-reset the system administrator's password without knowing the original credentials. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that ransomware groups are actively leveraging these weaknesses to compromise enterprise environments.


Security Officer Comments:
The speed at which these vulnerabilities have moved from disclosure to active ransomware exploitation is alarming. For our partners within the IT-ISAC, this represents a significant risk to organizational communication infrastructure. SmarterMail is often used by Small to Medium-sized Businesses (SMBs) and large enterprises alike as a cost-effective alternative to Exchange; however, its exposure to the public internet makes it a prime target for initial access brokers. The "RCE-as-a-feature" nature of these bugs, where administrative access can be immediately leveraged to execute OS commands via volume mount settings, means that once an attacker gains entry, the path to full domain compromise or ransomware deployment is extremely short. If your organization or any downstream members utilize SmarterMail, you should assume that sophisticated actors are actively scanning your external perimeter for these specific endpoints.


Suggested Corrections:
To defend against the current exploitation of SmarterMail vulnerabilities (CVE-2026-24423 and WT-2026-0001), organizations should prioritize the following actions:

• Immediate Patching: Upgrade SmarterMail to Build 9511 or later immediately. This release explicitly addresses the missing authentication in the ConnectToHub and force-reset-password API endpoints.
• Restrict Administrative Access: Use firewalls or reverse proxies to restrict access to the SmarterMail web interface and API endpoints to trusted IP addresses only. Avoid exposing the management portal to the open internet.
• Harden Administrative Accounts:
  • Rename the default "admin" or "administrator" accounts to obscure, non-obvious names to hinder automated guessing.
  • Enable Multi-Factor Authentication (MFA) for all administrative users.
• Egress Filtering: Implement network segmentation to restrict outbound connections from the mail server. Many of these RCE chains (like the ConnectToHub flaw) require the server to reach out to an attacker-controlled HTTP listener to fetch malicious commands.
• Endpoint Detection (EDR/AV): * Configure EDR solutions to monitor for anomalous child processes originating from SmarterMail[.]exe, such as cmd[.]exe, powershell[.]exe, or mshta[.]exe.
  • Monitor the SmarterMail upload directories (e.g., App_Data\upload) for the creation of unauthorized web shells or scripts.
• Log Monitoring and Hunting:
  • Audit web server logs for suspicious POST requests to /api/v1/auth/force-reset-password or /api/v1/settings/sysadmin/connect-to-hub.
  • Look for the user-agent python-requests/2.32.4, which has been observed in active exploitation attempts.
• Incident Response: If you discover your system was unpatched during the exploitation window, rotate all privileged credentials and inspect the "Volume Mounts" and "System Events" settings within SmarterMail for any unauthorized persistence mechanisms.

Link(s):
https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/