SmarterMail applications before build 9511 have an unauthenticated remote code execution vulnerability in the ConnectToHub API. When an attacker points the mail server at a malicious HTTP server that returns an OS command, the command is executed by the vulnerable application. This flaw allows, based on inference, anyone who can send requests to the API to run arbitrary commands with the privileges of the SmarterMail process, compromising confidentiality, integrity and availability.

The vulnerability affects SmarterMail from SmarterTools, specifically all builds prior to 9511. Administrators should check the build number of their installation and upgrade if it is below 9511.

The CVSS score of 9.3 indicates critical impact, and an EPSS score of 0.8% indicates a very low likelihood of exploitation. The vulnerability is listed in the CISA KEV catalog, underscoring that it is actively exploited. Exploitation requires no authentication and can be performed over the network by directing the service to the attacker-controlled server. Because the flaw is a lack of authentication (CWE-306), attackers can access the endpoint freely, escalating to remote code execution.