# CVE-2026-126624: hMailServer Windows installer privilege escalation in Bin folder

Source: https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126624 · Severity: high · CVSS 7.3 · Published 2026-11-11

hMailServer is an email server software that runs on Windows. When installed in certain directory locations (such as the root of a drive), the installer fails to properly secure file permissions, allowing any local user of the computer to replace or modify critical program files. An attacker can then inject malicious code that runs with system or administrator privileges, gaining complete control of the server and email data.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-126624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126624 being exploited in the wild.

**How severe is CVE-2026-126624?** High severity, with a CVSS score of 7.3, published 11 November 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.0.0 through 6.3.6.

**Is there a fix for CVE-2026-126624?** Yes: fixed in 6.3.8. Until then: Install hMailServer in the default Program Files directory, where Windows permissions prevent unprivileged users from modifying the program folder. Alternatively, ensure the installation directory is not at a volume root and has permissions set so only administrators can write to it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126624 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-126624?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.3.8

Install hMailServer in the default Program Files directory, where Windows permissions prevent unprivileged users from modifying the program folder. Alternatively, ensure the installation directory is not at a volume root and has permissions set so only administrators can write to it.

## Technical details

The vulnerability stems from unverified ownership and permissions in the Windows installer; inherited permissions from parent directories (such as drive roots) grant write access to unprivileged users for the program folder and Bin directory, even after the installer attempts to harden them in version 6.3.7. An authenticated local user can replace or inject libraries in the Bin folder that are loaded when setup, the Control Panel, or the service runs programs with elevated rights (administrator or LocalSystem), achieving local privilege escalation. The fix in 6.3.8 ensures new restrictive permissions override inherited ones and validates that no existing files are owned by or modifiable by non-administrators.

## Affected products

- Progressive Robot hMailServer 6.0.0 through 6.3.6

## Timeline

- 2026-11-11: disclosed: CVE-2026-126624 published

## References

- [https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8](https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8)
- [https://gitlab.com/hmailserver/hmailserver/-/work_items/78](https://gitlab.com/hmailserver/hmailserver/-/work_items/78)

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of)
- [Progressive Robot hMailServer TLS file path traversal on Windows](https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows)