Is CVE-2026-126612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126612 being exploited in the wild.

How severe is CVE-2026-126612?

High severity, with a CVSS score of 7.8, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.0.0 through 6.3.7.

How is CVE-2026-126612 attacked?

It is attacked with local access.

Am I affected by CVE-2026-126612?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126612: Progressive Robot hMailServer privilege escalation in Windows installer

CVE-2026-126612 · Severity: high · CVSS 7.8 · Published 2026-11-11

hMailServer is a mail server for Windows that includes an installer and service. The Windows installer fails to properly verify folder permissions when installing to non-standard locations, allowing a local user to inject code that runs with system or administrator privileges. An attacker with basic local access can exploit this to gain complete control of the mail server and the underlying system.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126612 being exploited in the wild.
How severe is CVE-2026-126612?: High severity, with a CVSS score of 7.8, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.0.0 through 6.3.7.
Is there a fix for CVE-2026-126612?: Yes: fixed in hMailServer 6.3.8. Until then: Install hMailServer to the default location under Program Files, which inherits secure NTFS permissions that prevent the vulnerability. Alternatively, ensure the installation folder and its parent directories are not writable by unprivileged users, and do not install through user-controlled junctions, symbolic links, or mount points. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126612 attacked?: It is attacked with local access.
Am I affected by CVE-2026-126612?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hMailServer 6.3.8

Install hMailServer to the default location under Program Files, which inherits secure NTFS permissions that prevent the vulnerability. Alternatively, ensure the installation folder and its parent directories are not writable by unprivileged users, and do not install through user-controlled junctions, symbolic links, or mount points.

Technical details

The vulnerability is an improper link resolution and permission check flaw (CWE-276) in the Windows installer and service startup. When hMailServer is installed to a path outside Program Files (such as a drive root) that inherits broad group write permissions, or when the path resolves through a junction, symbolic link, or mount point, an unprivileged local user can modify or replace programs in the Bin folder or plant malicious libraries. These programs run as LocalSystem (in older versions) or an elevated administrator context, allowing privilege escalation. The 6.3.7 hardening fix does not prevent exploitation through controlled links.

Affected products

Progressive Robot hMailServer 6.0.0 through 6.3.7

Timeline

2026-11-11: disclosed: CVE-2026-126612 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.