Is CVE-2026-126611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126611 being exploited in the wild.

How severe is CVE-2026-126611?

High severity, with a CVSS score of 7, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.3.4 through 6.3.7.

How is CVE-2026-126611 attacked?

It is attacked with local access or from the adjacent network, in a network appliance.

Am I affected by CVE-2026-126611?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126611: Progressive Robot hMailServer TLS certificate verification bypass

CVE-2026-126611 · Severity: high · CVSS 7 · Published 2026-11-11

hMailServer is an email server that uses a database to store configuration and mail. When configured with strict TLS certificate checking (verify-full mode) against a MySQL or MariaDB database but without a CA certificate file, the application fails to validate the database server's identity. An attacker with local network access can impersonate the database server, intercept the connection, and steal the database password or intercept and modify email server traffic.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126611 being exploited in the wild.
How severe is CVE-2026-126611?: High severity, with a CVSS score of 7, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.3.4 through 6.3.7.
Is there a fix for CVE-2026-126611?: No fixed version is recorded yet. Ensure a valid TLS CA certificate file (TlsCaFile) is configured alongside TlsMode=verify-full, or switch to a safer default TLS mode if strict certificate verification is not required. Restrict database server access to localhost only and monitor for unauthorized connections. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126611 attacked?: It is attacked with local access or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-126611?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Ensure a valid TLS CA certificate file (TlsCaFile) is configured alongside TlsMode=verify-full, or switch to a safer default TLS mode if strict certificate verification is not required. Restrict database server access to localhost only and monitor for unauthorized connections.

Technical details

The vulnerability occurs in hMailServer versions 6.3.4–6.3.7 when connecting to MySQL/MariaDB with TlsMode=verify-full and no TlsCaFile specified. MariaDB Connector/C 3.4.1+ treats connections to localhost/127.0.0.1/::1 as "local" and accepts self-signed or untrusted certificates regardless of hostname, contrary to the verify-full intent. An attacker able to intercept or stand in for the database server (e.g., by listening on the port while the legitimate server is stopped) can capture plaintext credentials and manipulate traffic. Windows builds bundle vulnerable Connector/C versions 3.4.9 (6.3.4–6.3.6) and 3.4.11 (6.3.7); Linux installations depend on the system's client library.

Affected products

Progressive Robot hMailServer 6.3.4 through 6.3.7

Timeline

2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.