# CVE-2026-114479: Progressive Robot hMailServer anti-virus attachment-stripping failure

Source: https://junglewise.ai/threats/cve-2026-114479-not-failing-securely-in-the-anti-virus-attachment-stripping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114479 · Severity: medium · CVSS 5.8 · Published 2026-10-21

hMailServer is an email server with built-in virus scanning that can be configured to strip infected attachments from messages while delivering the text portion. A flaw in versions 6.0.0 through 6.3.6 causes infected messages consisting of a single non-text part (such as an executable file, archive, or digitally signed email) to bypass this protection and be delivered to recipients intact, despite being flagged by the virus scanner. An attacker can craft such a message to deliver malware to any recipient, defeating the administrator's security control.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-114479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114479 being exploited in the wild.

**How severe is CVE-2026-114479?** Medium severity, with a CVSS score of 5.8, published 21 October 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.0.0 through 6.3.6.

**Is there a fix for CVE-2026-114479?** Yes: fixed in 6.3.7. Until then: Until upgrading to version 6.3.7, set the anti-virus action to delete the entire infected message (the default AVAction 0) rather than removing attachments only, wherever infected messages must not be delivered. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114479 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-114479?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.3.7

Until upgrading to version 6.3.7, set the anti-virus action to delete the entire infected message (the default AVAction 0) rather than removing attachments only, wherever infected messages must not be delivered.

## Technical details

The MessageAttachmentStripper component fails to handle single-part messages correctly when the anti-virus action is set to remove attachments. Single-part non-text messages (files sent as whole messages, S/MIME signed messages, or messages that cannot be read) are returned unprocessed and delivered with their infected content intact. The vulnerability requires virus scanning to be enabled with the attachment-removal action configured (not the default delete action); any unauthenticated sender can exploit this by crafting a message with a single infected non-text part.

## Affected products

- Progressive Robot hMailServer 6.0.0 through 6.3.6

## Timeline

- 2026-10-21: disclosed
- 2026-10-21: patched: Version 6.3.7 released

## References

- [https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7](https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7)
- [https://gitlab.com/hmailserver/hmailserver/-/work_items/92](https://gitlab.com/hmailserver/hmailserver/-/work_items/92)

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of)