Is CVE-2026-114479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114479 being exploited in the wild.

How severe is CVE-2026-114479?

Medium severity, with a CVSS score of 5.8, published 21 October 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.0.0 through 6.3.6.

How is CVE-2026-114479 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-114479?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114479: Progressive Robot hMailServer anti-virus attachment-stripping failure

CVE-2026-114479 · Severity: medium · CVSS 5.8 · Published 2026-10-21

hMailServer is an email server with built-in virus scanning that can be configured to strip infected attachments from messages while delivering the text portion. A flaw in versions 6.0.0 through 6.3.6 causes infected messages consisting of a single non-text part (such as an executable file, archive, or digitally signed email) to bypass this protection and be delivered to recipients intact, despite being flagged by the virus scanner. An attacker can craft such a message to deliver malware to any recipient, defeating the administrator's security control.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-114479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114479 being exploited in the wild.
How severe is CVE-2026-114479?: Medium severity, with a CVSS score of 5.8, published 21 October 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.0.0 through 6.3.6.
Is there a fix for CVE-2026-114479?: Yes: fixed in 6.3.7. Until then: Until upgrading to version 6.3.7, set the anti-virus action to delete the entire infected message (the default AVAction 0) rather than removing attachments only, wherever infected messages must not be delivered. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114479 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-114479?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.3.7

Until upgrading to version 6.3.7, set the anti-virus action to delete the entire infected message (the default AVAction 0) rather than removing attachments only, wherever infected messages must not be delivered.

Technical details

The MessageAttachmentStripper component fails to handle single-part messages correctly when the anti-virus action is set to remove attachments. Single-part non-text messages (files sent as whole messages, S/MIME signed messages, or messages that cannot be read) are returned unprocessed and delivered with their infected content intact. The vulnerability requires virus scanning to be enabled with the attachment-removal action configured (not the default delete action); any unauthenticated sender can exploit this by crafting a message with a single infected non-text part.

Affected products

Progressive Robot hMailServer 6.0.0 through 6.3.6

Timeline

2026-10-21: disclosed
2026-10-21: patched: Version 6.3.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.