Known exploited vulnerabilities
SmarterTools vulnerabilities attackers have used
Every SmarterTools vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 3 SmarterTools vulnerabilities as exploited in the wild, 3 of them added in the last 12 months and 3 used in ransomware campaigns. The most recent is CVE-2026-24423, added Feb 5, 2026. SmarterMail has the most entries (3).
- In KEV, all time
- 3
- Added, last 12 months
- 3
- Used in ransomware
- 3
- New CVEs this week
- 0
Every SmarterTools entry in CISA KEV
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the…
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password…
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code…
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.