SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 05/02/2026. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| smartermail | < 100.0.9511 | 100.0.9511 |
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free