Is CVE-2026-126609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126609 being exploited in the wild.

How severe is CVE-2026-126609?

High severity, with a CVSS score of 7.5, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.2.25 through 6.3.7.

How is CVE-2026-126609 attacked?

It is attacked with local access or over the network, in a hosted service.

Am I affected by CVE-2026-126609?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126609: hMailServer TLS certificate validation bypass on Windows with PostgreSQL

CVE-2026-126609 · Severity: high · CVSS 7.5 · Published 2026-11-11

hMailServer, a mail server application, fails to properly validate TLS certificates when connecting to PostgreSQL databases on Windows systems. An attacker with local file creation access can exploit character encoding confusion to trick the mail server into trusting a malicious certificate authority, allowing them to intercept and modify all traffic between the mail server and its database, including credentials.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126609 being exploited in the wild.
How severe is CVE-2026-126609?: High severity, with a CVSS score of 7.5, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.2.25 through 6.3.7.
Is there a fix for CVE-2026-126609?: No fixed version is recorded yet. Do not configure a root certificate file for PostgreSQL database connections, or restrict local file creation permissions to prevent attackers from creating files in writable directories alongside the configured certificate path. Use the bundled MariaDB Connector/C rather than the Oracle MySQL client library to avoid the vulnerability with MySQL connections. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126609 attacked?: It is attacked with local access or over the network, in a hosted service.
Am I affected by CVE-2026-126609?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not configure a root certificate file for PostgreSQL database connections, or restrict local file creation permissions to prevent attackers from creating files in writable directories alongside the configured certificate path. Use the bundled MariaDB Connector/C rather than the Oracle MySQL client library to avoid the vulnerability with MySQL connections.

Technical details

The vulnerability stems from improper handling of certificate file paths passed between libpq/OpenSSL layers on Windows. When a root certificate file name contains non-ASCII bytes that decode differently as Latin-1 versus UTF-8 (such as code page 1252 bytes C3 A9 which read as U+00E9 in UTF-8), OpenSSL opens the UTF-8-decoded file instead of the configured one. A local attacker can create the alternate filename and intercept the database connection or impersonate the server, achieving certificate validation bypass and traffic manipulation. The bundled MariaDB Connector/C is unaffected; only configurations using Oracle MySQL client library or PostgreSQL are vulnerable.

Affected products

Progressive Robot hMailServer 6.2.25 through 6.3.7

Timeline

2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.