CVE-2026-126619: Progressive Robot hMailServer SQL statement misinterpretation

CVE-2026-126619 · Severity: medium · CVSS 4.8 · Published 2026-11-11

hMailServer is a mail server application that handles email delivery and user authentication. A flaw in how the database layer processes SQL statements allows failed database operations—such as writing a delivered message or applying an IP ban—to be incorrectly reported as successful, potentially leading to missing audit trails, undelivered messages, and incorrect security policy enforcement without any error notification.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-126619 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126619 being exploited in the wild.
How severe is CVE-2026-126619?
Medium severity, with a CVSS score of 4.8, published 11 November 2026.
Which products and versions are affected?
Progressive Robot hMailServer 6.0.0-B1 through 6.3.7.
Is there a fix for CVE-2026-126619?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126619 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126619?
Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The database layer misinterprets the [IGNORE-ERRORS] marker in SQL statements, treating failed writes as successful when this marker appears in statement text. The vulnerability affects multiple database engines (MySQL/MariaDB, PostgreSQL, SQL Server, SQL Server Compact) through different code paths: values from untrusted sources (envelope addresses, usernames, message headers) may contain backslashes that cause the layer to misread statement boundaries and find the marker in literal text. Affected operations include message delivery logging, IP auto-ban tracking, and message metadata storage; successful exploitation requires only network access and does not grant privilege escalation or data manipulation.

Affected products

  • Progressive Robot hMailServer 6.0.0-B1 through 6.3.7

Timeline

  • 2026-11-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.