hMailServer: Incorrect default permissions in Windows installer
Summary
hMailServer 6.3.7 for Windows sets incorrect default permissions in its installer. If the server is installed into an existing folder that other accounts can write, such as a folder created at the root of a drive, a local authenticated user can run code with the rights of the administrator who runs setup. The default installation under Program Files is not affected.
Affected
- hMailServer 6.3.7 (per the CVE record)
- Installations into a pre-existing, non-administrator-writable program folder
Fixed in
- hMailServer 6.3.8 (per the CVE references)
Workaround
- Install only under Program Files, or into a new folder inside a location that only administrators may change.
- For existing installations outside Program Files, check the ACLs of the program folder, Bin and ControlPanel before upgrading.
Exploitation
- Attack requires a local, authenticated account.
- Not known to be exploited in the wild; no public proof of concept found.
Our recommendation
- Identify all hMailServer installations, their version and install path.
- Upgrade installations at 6.3.7 or earlier to 6.3.8.
- Check folder and file permissions before and after upgrading installations outside Program Files; reinstall into an administrator-only location if needed.
- Restrict local logons on the mail server to trusted accounts and monitor for changes in the hMailServer program folder.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.8 release (GitLab) gitlab.com
- Work item #78 (GitLab) gitlab.com
- CVE-2026-107571 record (CVE.org) www.cve.org
- CVE-2026-126622 entry (OffSeq) radar.offseq.com
- CVE-2026-126622 entry (ThreatInt) cve.threatint.com
- hMailServer 6.3.8 release mirror (GitHub) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:28.
Original description (NVD)
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.