CISA warns of SmarterMail RCE flaw used in ransomware attacks

CISA warns that SmarterMail contained a critical unauthenticated RCE vulnerability (CVE-2026-24423) in the ConnectToHub API that ransomware actors have exploited; an additional authentication-bypass allowing admin password resets was also reported. SmarterTools released fixes (build 9511 and subsequent 9526), and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and required remediation or product discontinuation under BOD 22-01 by February 26, 2026.