# CVE-2026-126617: Progressive Robot hMailServer SQL injection in database layer

Source: https://junglewise.ai/threats/cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126617 · Severity: high · CVSS 8.8 · Published 2026-11-11

hMailServer is a mail server that manages email delivery. A SQL injection vulnerability in versions 6.0.0-B1 through 6.2.18 allows attackers to alter database queries when MySQL/MariaDB or PostgreSQL is used as the backend. Unauthenticated remote attackers can exploit this through specially crafted email messages or responses, potentially leading to unauthorized data access, modification, or deletion of email data and mail server configurations.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-126617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126617 being exploited in the wild.

**How severe is CVE-2026-126617?** High severity, with a CVSS score of 8.8, published 11 November 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.0.0-B1 through 6.2.18.

**Is there a fix for CVE-2026-126617?** No fixed version is recorded yet. Use SQL Server or SQL Server Compact as the database backend, which employ parameterized queries and are not affected by this vulnerability. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126617 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-126617?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use SQL Server or SQL Server Compact as the database backend, which employ parameterized queries and are not affected by this vulnerability.

## Technical details

The vulnerability exists in SQLStatement::GenerateFromCommand, which constructs SQL queries by concatenating quoted parameter values into statement text via string replacement rather than using parameterized queries. Attackers can inject SQL by crafting parameter values whose quoted content breaks out of the literal context. Unauthenticated remote attackers can reach vulnerable code paths through delivery failure notices, automatic replies, and when greylisting or message indexing are enabled, through envelope addresses or IMAP SORT metadata headers. On PostgreSQL, multiple statements can be executed; on MySQL/MariaDB, injection is confined to a single statement.

## Affected products

- Progressive Robot hMailServer 6.0.0-B1 through 6.2.18

## Timeline

- 2026-11-11: disclosed

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of)