IT SBIT Services
Schneeberger
DEEN
CVE tracker

hMailServer: Local privilege escalation through insecure installer permissions

CVE-2026-107571High 7.8

← All vulnerabilities

Summary

The Windows installer of hMailServer 6.0.0 through 6.3.6 leaves the program folder and its Bin folder with inherited permissions when the server is installed outside the default Program Files folder, for example at the root of a drive. A local user without administrator rights can then replace or alter the service program or libraries loaded from Bin. This leads to code execution as LocalSystem or the service's virtual account, or with the rights of an administrator running setup or maintenance tools. The default installation in Program Files is not affected.

Affected

  • hMailServer 6.0.0 through 6.3.6 on Windows
  • Only installations in a folder whose inherited permissions grant a broad group write access, for example the root of an NTFS drive
  • Default installation in Program Files is not affected

Fixed in

  • hMailServer 6.3.7

Workaround

  • Upgrade to 6.3.7 (the fix).
  • If an upgrade is not possible now: move the installation to a folder under Program Files or to a location with restrictive parent permissions, and limit the program folder and Bin to SYSTEM, Administrators and TrustedInstaller. This is not tested by the vendor.

Exploitation

  • Unknown. No public proof of concept or in-the-wild exploitation is known.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

  • Check where hMailServer is installed.
  • If it is at a drive root or in a folder with broad write access, upgrade to 6.3.7.
  • Verify the installer's Authenticode signature (Progressive Robot Ltd) before running it.
  • After the upgrade, check the Bin folder for unexpected or modified files and DLLs.
  • Restrict local logons, including Remote Desktop, on the mail server.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:40.

Original description (NVD)

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed