# CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

- Exploited (CISA KEV): yes, added 2026-02-05, known ransomware use
- Published: 2026-01-23
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: 88.2% (100th percentile)
- CWE: CWE-306

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2026-05-04 | 101 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-05-04 · new · rule d86d8873310d41f2877458a91e053dce · default Block
  > SmarterMail - Remote Code Execution - CVE:CVE-2026-24423. Previous action: Log. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-05-04-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2026-24423, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2026-24423, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-24423 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-24423