Is CVE-2026-126615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126615 being exploited in the wild.

How severe is CVE-2026-126615?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7.

How is CVE-2026-126615 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126615?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126615: Progressive Robot hMailServer authentication bypass and lockout evasion

CVE-2026-126615 · Severity: medium · CVSS 5.3 · Published 2026-11-11

hMailServer is an email server that manages user accounts and controls access to mailboxes. The software contains a flaw in how it handles login attempts: attackers can bypass account lockout protections by using alternate spellings of the account name (such as using accented letters or full-width characters), and can sign into supposedly compromised accounts that are under review. This allows unlimited password guessing attacks and unauthorized access to locked or suspended accounts.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126615 being exploited in the wild.
How severe is CVE-2026-126615?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7.
Is there a fix for CVE-2026-126615?: No fixed version is recorded yet. Disable the per-name lockout feature (set AccountLockoutThreshold to 0 in hMailServer.ini) and disable compromised-account detection if not essential, to prevent the dual-spelling bypass from being exploitable. Alternatively, configure strict password policies and network-level rate limiting on IMAP, POP3, and SMTP ports to mitigate password-guessing attacks. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126615 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126615?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable the per-name lockout feature (set AccountLockoutThreshold to 0 in hMailServer.ini) and disable compromised-account detection if not essential, to prevent the dual-spelling bypass from being exploitable. Alternatively, configure strict password policies and network-level rate limiting on IMAP, POP3, and SMTP ports to mitigate password-guessing attacks.

Technical details

The vulnerability stems from a mismatch between how hMailServer normalizes login names for lockout/hold checks versus how the backend database normalizes names for account lookup. An attacker can supply account names in alternate encodings (accented letters, full-width characters, case variations, or whitespace variants) that the lockout mechanism treats as distinct from the original, each with its own attempt counter, but which the database resolves to the same account for password verification. This bypasses per-name lockout thresholds and compromised-account holds. The flaw affects OAuth 2.0, client certificates, Kerberos, and SAML/OpenID Connect authentication as well.

Affected products

Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7

Timeline

2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.