IT SBIT Services
Schneeberger
DEEN
CVE tracker

hMailServer: Unverified file ownership enables local privilege escalation

CVE-2026-126624High 7.3

← All vulnerabilities

Summary

hMailServer 6.3.7 on Windows does not remove existing ownership or write permissions from programs, libraries, scripts and settings files when setup installs into or upgrades a folder that other accounts can already write to, such as a folder created at the root of a drive. A local authenticated user can plant or change such files and run code as the mail server's service account or as an administrator. The default installation under Program Files is not affected.

Affected

  • hMailServer 6.3.7 (according to the CVE record)
  • Installations outside Program Files in a folder that non-administrator accounts can write to
  • The default installation under Program Files is not affected

Fixed in

  • Upgrade to hMailServer 6.3.8. Per the vendor, the 6.3.8 setup checks the folders and refuses to install where unsafe ownership or permissions remain.

Workaround

  • Install hMailServer under Program Files, or in a new folder inside one that only administrators may change (vendor interim advice)
  • Limit local interactive logons on mail servers to administrators

Exploitation

  • No exploitation in the wild found at the time of research.
  • No public proof of concept found. An unverified honeypot mention exists.

Our recommendation

  • Upgrade all installations to hMailServer 6.3.8.
  • Check the install path. Installations under Program Files need no further action beyond the upgrade.
  • For installations outside Program Files, review the NTFS permissions and ownership of the program folder, Bin, ControlPanel, the event script, add-ons and database scripts, and remove access for non-administrator accounts.
  • Restrict local logons on mail servers and monitor for unexpected file changes in the installation folder.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:28.

Original description (NVD)

Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed