Is CVE-2026-114474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114474 being exploited in the wild.

How severe is CVE-2026-114474?

Medium severity, with a CVSS score of 5.9, published 21 October 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.0.0 through 6.3.6.

How is CVE-2026-114474 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-114474?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114474: hMailServer SPF/DMARC bypass via external account forwarding

CVE-2026-114474 · Severity: medium · CVSS 5.9 · Published 2026-10-21

hMailServer is an email server that downloads mail from external accounts (like Gmail or Yahoo) and forwards it to users. A flaw in versions 6.0.0 through 6.3.6 allows attackers to forge the sender address of forwarded messages to impersonate a domain the server hosts, bypassing SPF and DMARC authentication checks. This enables phishing attacks where fraudulent emails appear to come from trusted domains.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-114474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114474 being exploited in the wild.
How severe is CVE-2026-114474?: Medium severity, with a CVSS score of 5.9, published 21 October 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.0.0 through 6.3.6.
Is there a fix for CVE-2026-114474?: Yes: fixed in hMailServer 6.3.7. Until then: Until upgrading, do not forward or redirect mail from accounts that collect external mailboxes if the external mail's From header can name a domain the server hosts. On servers using SmtpAuthenticatedSenderCheck, set reader_fetch_accounts_max to 0 to prevent users from adding their own external accounts, and review existing external accounts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114474 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-114474?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hMailServer 6.3.7

Until upgrading, do not forward or redirect mail from accounts that collect external mailboxes if the external mail's From header can name a domain the server hosts. On servers using SmtpAuthenticatedSenderCheck, set reader_fetch_accounts_max to 0 to prevent users from adding their own external accounts, and review existing external accounts.

Technical details

The vulnerability is an improper trust of the From header when setting the SMTP envelope sender (MAIL FROM) for messages downloaded from external accounts via POP3/IMAP. When such a message is forwarded or redirected to an external recipient, the server incorrectly uses the From header address as the envelope sender without validation, allowing an attacker to forge a sender address at any hosted domain. This bypasses SPF alignment and DMARC validation at the receiving mail server, as the Sender Rewriting Scheme does not modify envelope senders for hosted domains.

Affected products

Progressive Robot hMailServer 6.0.0 through 6.3.6

Timeline

2026-10-21: disclosed
2026-10-21: patched: hMailServer 6.3.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.