Tag

#missing-authentication

1 post tagged #missing-authentication.

Analysis · May 5, 2026 · The Field Notes Desk

SmarterMail's ConnectToHub API gave attackers SYSTEM in a single POST request

CVE-2026-24423 is an unauthenticated RCE in SmarterMail's ConnectToHub API. No credentials, no interaction, CVSS 9.8, confirmed ransomware. One of three critical SmarterMail CVEs in ten days. Here's what happened and what to do about it.