CISA Warns of Actively Exploited SmarterMail Flaw in Ransomware Attacks The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert after adding CVE-2026-24423, a critical vulnerability in SmarterTools SmarterMail, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is being actively exploited in ransomware campaigns, posing a severe risk to mail server infrastructure globally. The vulnerability stems from a Missing Authentication for Critical Function (CWE-306) weakness in SmarterMail’s ConnectToHub API method. Due to a programming oversight, unauthenticated attackers can remotely invoke the API, forcing a vulnerable SmarterMail instance to connect to an attacker-controlled server. Malicious responses containing OS commands are then executed with system-level privileges, enabling Remote Code Execution (RCE) and potential full compromise of the email environment. Security researchers report that threat actors are leveraging this exploit to deploy privilege escalation tools, network discovery utilities, and ransomware payloads, encrypting files across enterprise networks. Email servers remain prime targets due to their sensitive data and role in lateral movement within corporate systems. Federal agencies have been mandated to remediate the issue by February 26, 2026, though CISA strongly advises private organizations to patch immediately due to ongoing exploitation. SmarterTools has released a fix, and mitigations such as restricting API access via a Web Application Firewall (WAF) or isolating affected servers are recommended for organizations unable to patch immediately. If mitigations are unfeasible, CISA advises discontinuing use of vulnerable builds until secure updates are deployed. Successful exploitation can lead to data exfiltration, operational disruption, and widespread ransomware deployment, underscoring the urgency of addressing this flaw.