Is CVE-2026-126607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126607 being exploited in the wild.

How severe is CVE-2026-126607?

High severity, with a CVSS score of 7.8, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows with MySQL or MariaDB database.

How is CVE-2026-126607 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-126607?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126607: Progressive Robot hMailServer path traversal in MariaDB Connector plugin loading

CVE-2026-126607 · Severity: high · CVSS 7.8 · Published 2026-11-11

hMailServer is a mail server for Windows that manages email messaging. When configured with a MySQL or MariaDB database, it passes authentication plugin paths to the bundled MariaDB Connector/C in a way that can be misinterpreted across different character encodings. A local authenticated user can exploit this to place a malicious DLL in an alternate path that gets loaded with system privileges, achieving code execution as the mail server service account.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126607 being exploited in the wild.
How severe is CVE-2026-126607?: High severity, with a CVSS score of 7.8, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows with MySQL or MariaDB database.
Is there a fix for CVE-2026-126607?: Yes: fixed in hMailServer 6.3.8. Until then: Use the default installation folder under Program Files (which is ASCII and not vulnerable to encoding confusion), or restrict local authenticated user access to folder creation at drive roots and writable volumes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126607 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-126607?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hMailServer 6.3.8

Use the default installation folder under Program Files (which is ASCII and not vulnerable to encoding confusion), or restrict local authenticated user access to folder creation at drive roots and writable volumes.

Technical details

The vulnerability is a character encoding confusion leading to arbitrary DLL loading. hMailServer encodes the plugin folder path using wcstombs_s in the C locale (Latin-1 bytes), which the MariaDB Connector/C interprets via the system's ANSI code page when calling LoadLibraryExA. An attacker with local authentication and folder creation privileges can create a folder whose name results from decoding those Latin-1 bytes as a different code page (e.g., 1251 or UTF-8), place a malicious DLL matching a plugin name, and trigger loading when the service makes a database connection. Additionally, administrative tools run from writable locations and load plugins from the current drive root if the path contains characters above U+00FF, allowing privilege escalation.

Affected products

Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows with MySQL or MariaDB database

Timeline

2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.