# CVE-2026-126622: Progressive Robot hMailServer incorrect default installer permissions

Source: https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126622 · Severity: high · CVSS 7.3 · Published 2026-11-11

hMailServer is a Windows-based mail server software. When installed into a non-standard folder location with inherited permissions that allow broad write access (such as the root of a drive), local users on the system can replace the server's executable files and libraries with malicious versions. This allows unprivileged attackers to execute code with the same high privileges as the mail server service or administrator running updates, leading to complete system compromise.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-126622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126622 being exploited in the wild.

**How severe is CVE-2026-126622?** High severity, with a CVSS score of 7.3, published 11 November 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.0.0 through 6.3.6.

**Is there a fix for CVE-2026-126622?** Yes: fixed in 6.3.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126622 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-126622?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.3.8

## Technical details

A local privilege escalation in the Windows installer affecting hMailServer 6.0.0 through 6.3.6 occurs when the installation folder is placed in a location with inherited permissions granting broad write access (CWE-276). The installer creates the program folder and Bin subdirectory but does not set restrictive ACLs; Windows library loading searches the Bin folder before system directories, allowing any local user who can write to the folder to plant a malicious DLL that gets loaded when the service starts (as LocalSystem or a service account) or when setup and admin tools run with elevated privileges. This requires local authentication only, not network access.

## Affected products

- Progressive Robot hMailServer 6.0.0 through 6.3.6

## Timeline

- 2026-11-11: disclosed

## References

- [https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8](https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8)
- [https://gitlab.com/hmailserver/hmailserver/-/work_items/78](https://gitlab.com/hmailserver/hmailserver/-/work_items/78)

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer TLS file path traversal on Windows](https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows)