Critical · published January 23, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🔥 An unauthenticated remote code execution vulnerability in SmarterTools SmarterMail is a nightmare waiting to happen! Think of it like a restaurant receiving orders from a customer who never even walked through the door — they could send in a recipe for chaos without anyone checking the credentials. This flaw lets attackers serve up malicious commands without breaking a sweat! An attacker could easily redirect the SmarterMail to a malicious server, executing any command they desire — imagine them rummaging through sensitive data, changing configurations, or even wiping everything clean! The potential damage is absolutely devastating, leaving your systems wide open to exploitation!
Think of it like a restaurant receiving orders from a customer who never even walked through the door — they could send in a recipe for chaos without anyone checking the credentials. This flaw lets attackers serve up malicious commands without breaking a sweat! This vulnerability exists in the ConnectToHub API method of SmarterMail versions prior to build 9511, allowing attackers to execute arbitrary OS commands by pointing the application to a malicious HTTP server.
An attacker could easily redirect the SmarterMail to a malicious server, executing any command they desire — imagine them rummaging through sensitive data, changing configurations, or even wiping everything clean! The potential damage is absolutely devastating, leaving your systems wide open to exploitation! Patch immediately to build 9511 or later to close this critical vulnerability. It's vital to review your server configurations and ensure that only trusted sources are allowed to connect. Regularly audit your systems for any unusual activity as an added precaution. You've got this! Patch up, lock it down, and keep your systems safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| smartertools/smartermail | < 100.0.9511 | 100.0.9511 |