Local Code Execution Vulnerability in hMailServer by Progressive Robot
CVE-2026-126607

7.8HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126607?

The vulnerability in hMailServer affects versions from 6.2.3 to 6.3.7 on Windows, using a MySQL or MariaDB database. It arises when the system improperly handles authentication plugin folder paths, allowing local authenticated users to execute arbitrary code under the service account's privileges. By leveraging character encoding discrepancies between ANSI code pages, an attacker can create a malicious DLL in a uniquely named folder, leading to unauthorized code execution during the server's connection attempts. This vulnerability emphasizes the importance of running the latest software version, as hMailServer 6.3.8 addresses these issues by appropriately validating plugin folder paths and enhancing overall system security.

Affected Version(s)

hMailServer 6.2.3 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/116
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.