# SmarterMail Dual-CVE Pre-Auth RCE Chain — CVE-2026-23760 Admin Password Reset + CVE-2026-24423 ConnectToHub RCE, CISA KEV, Mass Automated Exploitation, 2-Day Patch Weaponization via .NET Decompiler

> Two critical SmarterMail vulnerabilities (CVE-2026-23760 and CVE-2026-24423) enable unauthenticated remote code execution against SmarterTools SmarterMail email servers. Both are in CISA's Known Exploited Vulnerabilities catalog with confirmed mass automated exploitation in the wild. CVE-2026-23760 allows anonymous admin password reset via the force-reset-password API, while CVE-2026-24423 enables unauthenticated RCE via the ConnectToHub API. Attackers chain the auth bypass with SmarterMail's built-in System Events functionality to execute OS commands as SYSTEM. Exploitation began within 2 days of the patch release — attackers reverse-engineered the security fix using decompilers.

- **Published:** 2026-02-05T23:18:00Z
- **Last reviewed:** 2026-02-05T23:18:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0103
- **ID:** TL-2026-0103
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Warlock (China)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-24423, CVE-2026-23760, CVE-2025-52691

## Description

SmarterTools SmarterMail versions prior to build 9511 contain two critical unauthenticated vulnerabilities that together provide complete server compromise.

CVE-2026-23760 (CWE-288, CVSS 4.0: 9.3) — Authentication Bypass via Password Reset API: The /api/v1/auth/force-reset-password endpoint is marked AllowAnonymous and accepts an IsSysAdmin boolean flag in the JSON body. When IsSysAdmin is true, the system administrator path executes WITHOUT validating the OldPassword field. An attacker supplies the admin username and a new password — the administrator account is reset instantly. Ironically, the regular user password reset path DOES validate the old password; only the privileged administrator path skips this check. Added to CISA KEV on January 26, 2026 with remediation deadline February 16, 2026.

CVE-2026-24423 (CWE-306, CVSS 4.0: 9.3) — Unauthenticated RCE via ConnectToHub API: The ConnectToHub API method in SystemAdminSettingsController lacks authentication. An attacker can point SmarterMail to a malicious HTTP server, which serves a malicious OS command that the application executes. Added to CISA KEV on February 5, 2026 with remediation deadline February 26, 2026.

The attack chain observed in the wild (documented by Huntress): (1) POST /api/v1/auth/force-reset-password — reset admin password, (2) POST /api/v1/auth/authenticate-user — obtain access token, (3) POST /api/v1/settings/sysadmin/event-hook — configure malicious System Event, (4) POST /api/v1/settings/sysadmin/domain-put — trigger the event, (5-6) domain-delete + event-hook-delete — clean up indicators. Requests were automated using Python requests/2.32.4 and executed in quick succession across multiple victims.

watchTowr (Sina Kheirkhah & Piotr Bazydlo) discovered CVE-2026-23760 and published WT-2026-0001 after observing that attackers had already reverse-engineered the patch within 2 days of release (build 9511, Jan 15, 2026). Markus Wulftange of CODE WHITE GmbH independently discovered both CVEs. Cale Black of VulnCheck also credited. Huntress DE&TH team confirmed mass automated exploitation with 28 source IPs.

A third vulnerability, CVE-2025-52691 (arbitrary file upload RCE), was also being mass exploited concurrently — making SmarterMail servers a triple-threat target. SmarterTools responded with rapid patching: build 9511 (Jan 15), 9518 (Jan 22 — critical security fixes), 9526 (Jan 30), and 9540 (Feb 13 — codebase obfuscation, command-line hardening).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1098 Account Manipulation
- T1078.003 Local Accounts
- T1070 Indicator Removal
- T1556 Modify Authentication Process
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1531 Account Access Removal
- T1505 Server Software Component
- T1210 Exploitation of Remote Services
- T1587.004 Exploits
- T1505.003 Web Shell
- T1070.007 Clear Network Connection History and Configurations
- T1087.001 Local Account
- T1114.001 Local Email Collection
- T1595.002 Vulnerability Scanning
- T1491.001 Internal Defacement

## Sources

- [NVD — CVE-2026-24423: SmarterMail ConnectToHub Unauthenticated RCE](https://nvd.nist.gov/vuln/detail/CVE-2026-24423)
- [NVD — CVE-2026-23760: SmarterMail Auth Bypass via Password Reset](https://nvd.nist.gov/vuln/detail/CVE-2026-23760)
- [VulnCheck — SmarterMail Unauthenticated RCE via ConnectToHub](https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api)
- [watchTowr — Attackers With Decompilers Strike Again (WT-2026-0001)](https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/)
- [Huntress — SmarterMail Account Takeover Leading to RCE (ITW Exploitation)](https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce)
- [CODE WHITE — Public Vulnerability List (Both CVEs)](https://code-white.com/public-vulnerability-list/)
- [SmarterTools — SmarterMail Release Notes (Builds 9504-9540)](https://www.smartertools.com/smartermail/release-notes/current)
- [CISA KEV — CVE-2026-24423 (Added Feb 5, 2026)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423)
- [CISA KEV — CVE-2026-23760 (Added Jan 26, 2026)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0103