smartertools vulnerabilities (CVEs)

45 CVEs matched to smartertools by name in NVD, 2 on CISA's Known Exploited list.

Back to the smartertools profile · Alternatives to smartertools · CVE RSS feed

Exploitation riskConfirmed exploited

45 of 45 CVEs assessed

confirmed exploited

used in ransomware

past CISA deadline

EPSS ≥ 10%

>99%

highest single CVE

6 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2026-24423 ↗⚠ exploitedransomwareoverdueEPSS 88%LEV ≥>99%Confirmed exploited
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacke…
CVE-2026-23760 ↗⚠ exploitedransomwareoverdueEPSS 96%LEV ≥>99%Confirmed exploited

Recent changes

last 90 days

CVE-2019-7214 exploitation forecast rose from 74.5% to 84.8% in a day.2026-09-22 · NVD ↗
CVE-2019-7214 exploitation forecast rose from 74.5% to 84.8% in a day.2026-09-06 · NVD ↗
CVE-2023-48116 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2015-9276 is now estimated at a 65% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2023-48115 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Total
2026	2	2	2	6
2023	0	0	3	3
2022	0	2	1	3
2021	1	1	3	5
2019	1	1	3	5
2011	0	6	9	15
2010	0	0	2	2
2008	0	0	1	1
2004	0	1	4	5

On CISA's Known Exploited Vulnerabilities list

2 of 45 matched CVEs are listed. 2 are past the remediation due date CISA set. 2 are flagged by CISA as known to be used in ransomware campaigns.

Most recent additions

CVE-2026-24423 added 2026-02-05
CVE-2026-23760 added 2026-01-26

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2026-23760	96%	>99%
CVE-2026-24423	88%	>99%
CVE-2019-7214	85%	>99%
CVE-2019-7213	42%	99%
CVE-2011-2148	5.3%	93%
CVE-2011-2158	4.4%	91%
CVE-2011-2159	4.4%	91%
CVE-2022-24384	4.1%	91%
CVE-2011-2155	3.9%	90%
CVE-2011-2150	3.0%	87%

Known CVEs (45)

RSS ⇢

CVE-2026-7807 ↗HIGH 8.12026
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json fil…
CVE-2026-40514 ↗MEDIUM 5.92026
SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from Sys…
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to smartertools by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.