Local Code Execution Vulnerability in hMailServer by Progressive Robot

CVE-2026-126622

What is CVE-2026-126622?

The Progressive Robot hMailServer 6.3.7 contains a vulnerability due to incorrect default permissions in its Windows installer. This flaw allows a local authenticated user to execute code with elevated privileges as the administrator, particularly if the server is set up in an already existing program folder that is writable by non-administrators or during upgrades and repairs. Although version 6.3.7 attempted to address previous vulnerabilities by restricting permissions on certain folders, it failed to secure permissions immediately on existing folders at installation start. As a result, it is possible for a malicious user to replace files in the 'Bin' directory during the setup process, executing those unauthorized files with administrative rights. This risk highlights the necessity for administrators to ensure secure environments before installing or upgrading hMailServer.

References