Is CVE-2026-107571 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107571 being exploited in the wild.

How severe is CVE-2026-107571?

High severity, with a CVSS score of 7.8, published 19 October 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.0.0 through 6.3.6.

How is CVE-2026-107571 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-107571?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107571: hMailServer Windows installer privilege escalation via incorrect folder permissions

CVE-2026-107571 · Severity: high · CVSS 7.8 · Published 2026-10-19

hMailServer is an open-source mail server for Windows. The Windows installer fails to properly restrict folder permissions when installed outside the default Program Files location, allowing any local user on the computer to modify or replace critical mail server programs. This enables an unprivileged attacker to run malicious code with the same high privileges (system-level or administrator rights) that the mail server and administrative tools use, leading to complete system compromise.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-107571 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107571 being exploited in the wild.
How severe is CVE-2026-107571?: High severity, with a CVSS score of 7.8, published 19 October 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.0.0 through 6.3.6.
Is there a fix for CVE-2026-107571?: Yes: fixed in 6.3.7. Until then: Install hMailServer to the default Program Files folder, which uses restrictive permissions that prevent this attack. If a non-default installation path must be used, manually set NTFS folder permissions on the program folder and Bin subdirectory to restrict write access to SYSTEM, Administrators, and TrustedInstaller only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107571 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-107571?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.3.7

Install hMailServer to the default Program Files folder, which uses restrictive permissions that prevent this attack. If a non-default installation path must be used, manually set NTFS folder permissions on the program folder and Bin subdirectory to restrict write access to SYSTEM, Administrators, and TrustedInstaller only.

Technical details

The vulnerability is a local privilege escalation (CWE-276) in the Windows installer's handling of NTFS folder permissions. When hMailServer is installed to a non-default path (such as the root of a drive), the program folder and Bin subdirectory inherit write permissions from the parent directory, allowing authenticated local users to modify or replace executables and DLL files. This affects versions 6.0.0 through 6.3.6; exploitation requires local filesystem access and an unprivileged local user account, but grants code execution as LocalSystem, the service's virtual account, or an elevated administrator, fixed in version 6.3.7.

Affected products

Progressive Robot hMailServer 6.0.0 through 6.3.6

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.