CISA Advisory Highlights Exploited SmarterTools Vulnerability in Recent Ransomware Attacks

CISA added SmarterMail CVE-2026-24423 to its Known Exploited Vulnerabilities list after researchers observed active exploitation by ransomware operators. The flaw is a Missing Authentication for Critical Function in the ConnectToHub API that allows unauthenticated remote attackers to induce the server to connect to attacker-controlled HTTP servers and execute returned OS commands, resulting in full RCE; administrators are urged to apply vendor patches, isolate or restrict API access, and monitor for suspicious outbound connections.