SmarterTools SmarterMail ConnectToHub API Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-24423) Urgent Security Advisory

# Stop SmarterMail service and download the latest patched installer (Build 9511 or higher)
Stop-Service -Name 'SmarterMail' -Force

$url = 'https://www.smartertools.com/downloads/smartermail/SmarterMail_Setup.exe'
$output = '$env:TEMP\SmarterMail_Setup.exe'
Invoke-WebRequest -Uri $url -OutFile $output

# Execute silent installation (Ensure backup is taken before running)
Start-Process -FilePath $output -ArgumentList '/s /v"/qn"' -Wait
Start-Service -Name 'SmarterMail'

<!-- Add to IIS web.config to block external access to the ConnectToHub API -->
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name='Block ConnectToHub API' stopProcessing='true'>
          <match url='.*ConnectToHub.*' />
          <conditions>
            <add input='{REMOTE_ADDR}' pattern='^127\.0\.0\.1$' negate='true' />
          </conditions>
          <action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied' />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

# Search SmarterMail W3C logs for ConnectToHub API calls
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC*\*.log'
Select-String -Path $LogPath -Pattern 'ConnectToHub' | Select-Object -First 50

# Monitor active outbound connections initiated by the SmarterMail process
$PID = (Get-Process -Name 'MailServer' -ErrorAction SilentlyContinue).Id
if ($PID) {
    Get-NetTCPConnection -OwningProcess $PID | Where-Object { $_.RemoteAddress -ne '127.0.0.1' -and $_.State -eq 'Established' }
}