SmarterMail Dual-CVE Pre-Auth RCE Chain — CVE-2026-23760 Admin Password Reset + CVE-2026-24423 ConnectToHub RCE, CISA KEV, Mass Automated Exploitation, 2-Day Patch Weaponization via .NET Decompiler
SmarterMail Dual-CVE Pre-Auth RCE Chain (TL-2026-0103) is a critical-severity software vulnerability, first published 2026-02-05. It is attributed to Warlock (China) with medium confidence, references 2 CVEs (CVE-2026-24423, CVE-2026-23760), maps to 20 MITRE ATT&CK techniques (T1005, T1059, T1070), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0103
- Threat ID
- TL-2026-0103
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-02-05
- Last reviewed
- 2026-02-05
- Attribution
- Warlock
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- financial
- Target sectors
- Technology, Government, Healthcare, Education, Small Business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 33
Two critical SmarterMail vulnerabilities (CVE-2026-23760 and CVE-2026-24423) enable unauthenticated remote code execution against SmarterTools SmarterMail email servers. Both are in CISA's Known Exploited Vulnerabilities catalog with confirmed mass automated exploitation in the wild. CVE-2026-23760 allows anonymous admin password reset via the force-reset-password API, while CVE-2026-24423 enables unauthenticated RCE via the ConnectToHub API. Attackers chain the auth bypass with SmarterMail's built-in System Events functionality to execute OS commands as SYSTEM. Exploitation began within 2 days of the patch release — attackers reverse-engineered the security fix using decompilers.
How SmarterMail Dual-CVE Pre-Auth RCE Chain works
SmarterTools SmarterMail versions prior to build 9511 contain two critical unauthenticated vulnerabilities that together provide complete server compromise.
CVE-2026-23760 (CWE-288, CVSS 4.0: 9.3) — Authentication Bypass via Password Reset API: The /api/v1/auth/force-reset-password endpoint is marked AllowAnonymous and accepts an IsSysAdmin boolean flag in the JSON body. When IsSysAdmin is true, the system administrator path executes WITHOUT validating the OldPassword field. An attacker supplies the admin username and a new password — the administrator account is reset instantly. Ironically, the regular user password reset path DOES validate the old password; only the privileged administrator path skips this check. Added to CISA KEV on January 26, 2026 with remediation deadline February 16, 2026.
CVE-2026-24423 (CWE-306, CVSS 4.0: 9.3) — Unauthenticated RCE via ConnectToHub API: The ConnectToHub API method in SystemAdminSettingsController lacks authentication. An attacker can point SmarterMail to a malicious HTTP server, which serves a malicious OS command that the application executes. Added to CISA KEV on February 5, 2026 with remediation deadline February 26, 2026.
The attack chain observed in the wild (documented by Huntress): (1) POST /api/v1/auth/force-reset-password — reset admin password, (2) POST /api/v1/auth/authenticate-user — obtain access token, (3) POST /api/v1/settings/sysadmin/event-hook — configure malicious System Event, (4) POST /api/v1/settings/sysadmin/domain-put — trigger the event, (5-6) domain-delete + event-hook-delete — clean up indicators. Requests were automated using Python requests/2.32.4 and executed in quick succession across multiple victims.
watchTowr (Sina Kheirkhah & Piotr Bazydlo) discovered CVE-2026-23760 and published WT-2026-0001 after observing that attackers had already reverse-engineered the patch within 2 days of release (build 9511, Jan 15, 2026). Markus Wulftange of CODE WHITE GmbH independently discovered both CVEs. Cale Black of VulnCheck also credited. Huntress DE&TH team confirmed mass automated exploitation with 28 source IPs.
A third vulnerability, CVE-2025-52691 (arbitrary file upload RCE), was also being mass exploited concurrently — making SmarterMail servers a triple-threat target. SmarterTools responded with rapid patching: build 9511 (Jan 15), 9518 (Jan 22 — critical security fixes), 9526 (Jan 30), and 9540 (Feb 13 — codebase obfuscation, command-line hardening).
MITRE ATT&CK techniques used in TL-2026-0103
collection
T1005 Data from Local System; T1114.001 Local Email Collection
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
defense-evasion
T1070 Indicator Removal; T1070.007 Clear Network Connection History and Configurations; T1078.003 Local Accounts
command-and-control
discovery
T1082 System Information Discovery; T1087.001 Local Account
persistence
T1098 Account Manipulation; T1505 Server Software Component; T1505.003 Web Shell
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
impact
T1491.001 Internal Defacement; T1531 Account Access Removal
credential-access
T1556 Modify Authentication Process
resource-development
reconnaissance
Remediation for SmarterMail Dual-CVE Pre-Auth RCE Chain
Patches
- Build 9511 (Jan 15, 2026): Fixes CVE-2026-23760 and CVE-2026-24423
- Build 9518 (Jan 22, 2026): Additional critical security fixes
- Build 9526 (Jan 30, 2026): BIMI SSRF fix, JWT hardening, API scope fixes
- Build 9540 (Feb 13, 2026): Codebase obfuscation, command-line hardening, API IP restrictions
Immediate actions
- Update SmarterMail to build 9540 (latest, Feb 13, 2026) or at minimum build 9511 (Jan 15, 2026)
- Review system administrator accounts for unauthorized password changes — check SmarterMail logs for /api/v1/auth/force-reset-password POST requests
- Review System Events (event-hooks) for malicious entries — attackers use event-hooks to execute OS commands
- Block the 28 known exploitation source IPs from Huntress IOCs at firewall/WAF
- Check for result.txt in SmarterMail Service\wwwroot directory — this file contains attacker reconnaissance output
Workarounds
- If immediate patching is not possible, restrict all access to SmarterMail management port (default 9998) to trusted IPs only
- Disable System Events functionality if not required
- Monitor for new domain creation via API as an indicator of exploitation
Longer-term hardening
- Restrict SmarterMail management APIs to internal/VPN access only — /api/v1/settings/sysadmin/* should never be Internet-exposed
- Implement WAF rules to block unauthenticated POST to /api/v1/auth/force-reset-password
- Monitor SmarterMail API logs for automated attack patterns (python-requests user-agent, rapid sequential API calls)
- Consider migrating to SmarterMail Cloud or alternative email platform with stronger security posture
- Enable SmarterMail's new API IP restrictions feature (added in build 9540)
CVEs associated with SmarterMail Dual-CVE Pre-Auth RCE Chain
Weaknesses (CWE) in SmarterMail Dual-CVE Pre-Auth RCE Chain
CWE-306, CWE-288
Timeline of SmarterMail Dual-CVE Pre-Auth RCE Chain
- SmarterMail build 9504 released — last vulnerable version before security fixes. Source: https://www.smartertools.com/smartermail/release-notes/current
- SmarterMail build 9511 released with critical security fixes for CVE-2026-23760 and CVE-2026-24423. Marked 'IMPORTANT: Critical security fixes.' Removed CreatePrimarySystemAdmin and ValidateRemoteInstances API endpoints. Source: SmarterTools release notes
- Exploitation of CVE-2026-23760 observed in the wild — only 2 days after patch release. Attackers reverse-engineered the patch using .NET decompilers to reconstruct the vulnerability. SmarterMail forum user reported admin account compromised. Source: https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/
- watchTowr publishes WT-2026-0001 analysis with full PoC for CVE-2026-23760 auth bypass. Huntress publishes in-the-wild exploitation report with 28 source IPs and full attack chain documentation. Source: watchTowr Labs + Huntress
- SmarterMail build 9518 released with additional critical security fixes. Source: SmarterTools release notes
- VulnCheck publishes advisory for CVE-2026-24423 (ConnectToHub unauthenticated RCE) and CVE-2026-23760 (auth bypass). CVSS 4.0: 9.3 for both. Credit: Sina Kheirkhah & Piotr Bazydlo (watchTowr), Markus Wulftange (CODE WHITE), Cale Black (VulnCheck). Source: https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api
- CISA adds CVE-2026-23760 to Known Exploited Vulnerabilities catalog. Remediation deadline: February 16, 2026. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- SmarterMail build 9526 released with BIMI SSRF fix, JWT hardening, SimpleAuthController hardening, API scope corrections. Source: SmarterTools release notes
- CISA adds CVE-2026-24423 to Known Exploited Vulnerabilities catalog. Remediation deadline: February 26, 2026. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- SmarterMail build 9540 released: codebase obfuscation (to slow decompiler-based patch diffing), command-line execution changes, API IP restrictions feature, JSON deserialization fix. Source: SmarterTools release notes
- As of 2026-05-29, both SmarterMail CVEs remain under active in-the-wild exploitation: VulnCheck's Canary network reports "new detections still coming in," with ransomware (Warlock/Qilin) and China-linked actors (Storm-2603/Storm-1175) hitting 10k+ unpatched servers. Patches exist (build 9511+) but exploitation persists, so status escalates from PATCHED to ACTIVE.
Sources cited for SmarterMail Dual-CVE Pre-Auth RCE Chain
- NVD — CVE-2026-24423: SmarterMail ConnectToHub Unauthenticated RCE
- NVD — CVE-2026-23760: SmarterMail Auth Bypass via Password Reset
- VulnCheck — SmarterMail Unauthenticated RCE via ConnectToHub
- watchTowr — Attackers With Decompilers Strike Again (WT-2026-0001)
- Huntress — SmarterMail Account Takeover Leading to RCE (ITW Exploitation)
- CODE WHITE — Public Vulnerability List (Both CVEs)
- SmarterTools — SmarterMail Release Notes (Builds 9504-9540)
- CISA KEV — CVE-2026-24423 (Added Feb 5, 2026)
- CISA KEV — CVE-2026-23760 (Added Jan 26, 2026)
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-0103
As of 2026-02-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0103 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.