Is CVE-2026-100741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100741 being exploited in the wild.

How severe is CVE-2026-100741?

Critical severity, with a CVSS score of 9.8, published 27 September 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.0.0 through 6.3.3.

Is there a fix for CVE-2026-100741?

A patch was published on 2026-09-24: Fix committed; released in version 6.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100741 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-100741?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100741: Progressive Robot hMailServer code injection in JScript event dispatcher

CVE-2026-100741 · Severity: critical · CVSS 9.8 · Published 2026-09-27

hMailServer is a Windows mail server that runs with system-level privileges and supports scripted event handlers. An unauthenticated attacker can inject arbitrary JScript code and execute it within the server process by crafting a password containing a backslash-apostrophe combination, bypassing authentication entirely. This allows complete system compromise through the service account's privileges, but only affects servers with event scripting enabled and configured to use JScript rather than the default VBScript.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-100741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100741 being exploited in the wild.
How severe is CVE-2026-100741?: Critical severity, with a CVSS score of 9.8, published 27 September 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.0.0 through 6.3.3.
Is there a fix for CVE-2026-100741?: A patch was published on 2026-09-24: Fix committed; released in version 6.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100741 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-100741?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in hMailServer's JScript event-script dispatcher where event values (passwords, remote message UIDs, SMTP error replies) are embedded as string literals without proper backslash escaping. An attacker can terminate the string literal with a backslash-apostrophe sequence and inject arbitrary JScript statements that execute with the service account's privileges. The vulnerability is reachable via SMTP AUTH, POP3, IMAP authentication attempts naming existing accounts, or via remote server responses in POP3 downloads and SMTP delivery failures, requiring non-default configuration (event scripting enabled with JScript language and appropriate handlers defined). Versions 6.0.0 through 6.3.3 are affected on Windows; the fix is available in 6.3.4.

Affected products

Progressive Robot hMailServer 6.0.0 through 6.3.3

Timeline

2026-09-27: disclosed: CVE-2026-100741 published
2026-09-24: patched: Fix committed; released in version 6.3.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.