{"schema_version":1,"title":"Progressive Robot hMailServer vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 34 vulnerabilities in Progressive Robot hMailServer: 18 in the last 7 days and 34 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126626, was published on 11 November 2026. 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 0 critical against 1.","url":"https://junglewise.ai/threats/technologies/hmailserver","json_url":"https://junglewise.ai/threats/technologies/hmailserver.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/hmailserver","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":17,"all_time":34,"critical":1,"exploited":0,"last_7_days":18,"last_30_days":33,"last_90_days":34,"last_365_days":34},"latest":[{"cve":"CVE-2026-126626","cvss":5.3,"slug":"cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3","title":"Progressive Robot hMailServer denial of service in web services listener","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:14.973+00:00","url":"https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3"},{"cve":"CVE-2026-126625","cvss":6.7,"slug":"cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of","title":"hMailServer Windows installer privilege escalation via insecure folder permissions","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:14.833+00:00","url":"https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of"},{"cve":"CVE-2026-126624","cvss":7.3,"slug":"cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive","title":"hMailServer Windows installer privilege escalation in Bin folder","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.69+00:00","url":"https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive"},{"cve":"CVE-2026-126623","cvss":7.5,"slug":"cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of","title":"Progressive Robot hMailServer inefficient JSON parsing DoS","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.55+00:00","url":"https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of"},{"cve":"CVE-2026-126622","cvss":7.3,"slug":"cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of","title":"Progressive Robot hMailServer incorrect default installer permissions","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.413+00:00","url":"https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of"},{"cve":"CVE-2026-126621","cvss":7.5,"slug":"cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows","title":"Progressive Robot hMailServer TLS file path traversal on Windows","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.277+00:00","url":"https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows"},{"cve":"CVE-2026-126619","cvss":4.8,"slug":"cve-2026-126619-misinterpretation-of-sql-statement-text-in-the-database-layer-of","title":"Progressive Robot hMailServer SQL statement misinterpretation","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:14.133+00:00","url":"https://junglewise.ai/threats/cve-2026-126619-misinterpretation-of-sql-statement-text-in-the-database-layer-of"},{"cve":"CVE-2026-126618","cvss":5.3,"slug":"cve-2026-126618-the-auto-ban-of-progressive-robot-hmailserver-6-0-0-b1-through-6","title":"hMailServer account password brute-force via auto-ban bypass","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:14+00:00","url":"https://junglewise.ai/threats/cve-2026-126618-the-auto-ban-of-progressive-robot-hmailserver-6-0-0-b1-through-6"},{"cve":"CVE-2026-126617","cvss":8.8,"slug":"cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot","title":"Progressive Robot hMailServer SQL injection in database layer","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.86+00:00","url":"https://junglewise.ai/threats/cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot"},{"cve":"CVE-2026-126616","cvss":5.3,"slug":"cve-2026-126616-the-auto-ban-of-progressive-robot-hmailserver-6-2-0-through-6-3","title":"hMailServer auto-ban bypass via UTF-8 character handling","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:13.713+00:00","url":"https://junglewise.ai/threats/cve-2026-126616-the-auto-ban-of-progressive-robot-hmailserver-6-2-0-through-6-3"},{"cve":"CVE-2026-126615","cvss":5.3,"slug":"cve-2026-126615-the-sign-in-of-progressive-robot-hmailserver-6-2-22-pre2-through","title":"Progressive Robot hMailServer authentication bypass and lockout evasion","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:13.573+00:00","url":"https://junglewise.ai/threats/cve-2026-126615-the-sign-in-of-progressive-robot-hmailserver-6-2-22-pre2-through"},{"cve":"CVE-2026-126614","cvss":5.3,"slug":"cve-2026-126614-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3","title":"Progressive Robot hMailServer IP ranges bypass in web services listener","severity":"medium","exploited":false,"published_at":"2026-11-11T09:17:13.423+00:00","url":"https://junglewise.ai/threats/cve-2026-126614-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3"},{"cve":"CVE-2026-126613","cvss":7.5,"slug":"cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of","title":"Progressive Robot hMailServer JSON reader resource exhaustion","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.267+00:00","url":"https://junglewise.ai/threats/cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of"},{"cve":"CVE-2026-126612","cvss":7.8,"slug":"cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive","title":"Progressive Robot hMailServer privilege escalation in Windows installer","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.11+00:00","url":"https://junglewise.ai/threats/cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive"},{"cve":"CVE-2026-126611","cvss":7,"slug":"cve-2026-126611-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql","title":"Progressive Robot hMailServer TLS certificate verification bypass","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:12.973+00:00","url":"https://junglewise.ai/threats/cve-2026-126611-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql"},{"cve":"CVE-2026-126610","cvss":7.4,"slug":"cve-2026-126610-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql","title":"Progressive Robot hMailServer TLS CA file bypass","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:12.83+00:00","url":"https://junglewise.ai/threats/cve-2026-126610-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql"},{"cve":"CVE-2026-126609","cvss":7.5,"slug":"cve-2026-126609-progressive-robot-hmailserver-6-2-25-through-6-3-7-on-windows","title":"hMailServer TLS certificate validation bypass on Windows with PostgreSQL","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:12.687+00:00","url":"https://junglewise.ai/threats/cve-2026-126609-progressive-robot-hmailserver-6-2-25-through-6-3-7-on-windows"},{"cve":"CVE-2026-126607","cvss":7.8,"slug":"cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows","title":"Progressive Robot hMailServer path traversal in MariaDB Connector plugin loading","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:11.41+00:00","url":"https://junglewise.ai/threats/cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows"},{"cve":"CVE-2026-114490","cvss":7.8,"slug":"cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of","title":"hMailServer authorization bypass in COM administration API","severity":"high","exploited":false,"published_at":"2026-10-21T16:17:35.647+00:00","url":"https://junglewise.ai/threats/cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of"},{"cve":"CVE-2026-114489","cvss":8.1,"slug":"cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of","title":"Progressive Robot hMailServer missing authorization in REST and COM administration APIs","severity":"high","exploited":false,"published_at":"2026-10-21T16:17:35.5+00:00","url":"https://junglewise.ai/threats/cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of"},{"cve":"CVE-2026-114479","cvss":5.8,"slug":"cve-2026-114479-not-failing-securely-in-the-anti-virus-attachment-stripping","title":"Progressive Robot hMailServer anti-virus attachment-stripping failure","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:35.357+00:00","url":"https://junglewise.ai/threats/cve-2026-114479-not-failing-securely-in-the-anti-virus-attachment-stripping"},{"cve":"CVE-2026-114477","cvss":4.3,"slug":"cve-2026-114477-missing-authorization-in-the-rest-metrics-route-of-progressive","title":"Progressive Robot hMailServer missing authorization in REST metrics route","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:35.07+00:00","url":"https://junglewise.ai/threats/cve-2026-114477-missing-authorization-in-the-rest-metrics-route-of-progressive"},{"cve":"CVE-2026-114476","cvss":7.5,"slug":"cve-2026-114476-incorrect-authorization-in-the-rest-administration-api-of","title":"hMailServer REST API authorization bypass in role management","severity":"high","exploited":false,"published_at":"2026-10-21T16:17:34.947+00:00","url":"https://junglewise.ai/threats/cve-2026-114476-incorrect-authorization-in-the-rest-administration-api-of"},{"cve":"CVE-2026-114475","cvss":6.5,"slug":"cve-2026-114475-missing-authorization-in-the-rest-role-management-routes-of","title":"Progressive Robot hMailServer REST authorization bypass in role management","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:34.827+00:00","url":"https://junglewise.ai/threats/cve-2026-114475-missing-authorization-in-the-rest-role-management-routes-of"},{"cve":"CVE-2026-114474","cvss":5.9,"slug":"cve-2026-114474-use-of-a-less-trusted-source-for-the-envelope-sender-in-the","title":"hMailServer SPF/DMARC bypass via external account forwarding","severity":"medium","exploited":false,"published_at":"2026-10-21T16:17:34.707+00:00","url":"https://junglewise.ai/threats/cve-2026-114474-use-of-a-less-trusted-source-for-the-envelope-sender-in-the"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":15},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":18}],"related":[],"technology":{"hub":true,"name":"Progressive Robot hMailServer","slug":"hmailserver","vendor":{"hub":true,"name":"Progressive Robot","slug":"progressive-robot","url":"https://junglewise.ai/threats/vendors/progressive-robot"},"aliases":[],"category":"mail-server","description":"Open-source mail server software for managing email services on Windows and Linux systems.","url":"https://junglewise.ai/threats/technologies/hmailserver"},"most_severe":[{"cve":"CVE-2026-100741","cvss":9.8,"slug":"cve-2026-100741-eval-injection-in-the-jscript-event-script-dispatcher-in","title":"Progressive Robot hMailServer code injection in JScript event dispatcher","severity":"critical","exploited":false,"published_at":"2026-09-27T08:16:26.813+00:00","url":"https://junglewise.ai/threats/cve-2026-100741-eval-injection-in-the-jscript-event-script-dispatcher-in"},{"cve":"CVE-2026-126617","cvss":8.8,"slug":"cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot","title":"Progressive Robot hMailServer SQL injection in database layer","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.86+00:00","url":"https://junglewise.ai/threats/cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot"},{"cve":"CVE-2026-114489","cvss":8.1,"slug":"cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of","title":"Progressive Robot hMailServer missing authorization in REST and COM administration APIs","severity":"high","exploited":false,"published_at":"2026-10-21T16:17:35.5+00:00","url":"https://junglewise.ai/threats/cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of"},{"cve":"CVE-2026-126612","cvss":7.8,"slug":"cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive","title":"Progressive Robot hMailServer privilege escalation in Windows installer","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.11+00:00","url":"https://junglewise.ai/threats/cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive"},{"cve":"CVE-2026-126607","cvss":7.8,"slug":"cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows","title":"Progressive Robot hMailServer path traversal in MariaDB Connector plugin loading","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:11.41+00:00","url":"https://junglewise.ai/threats/cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows"},{"cve":"CVE-2026-114490","cvss":7.8,"slug":"cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of","title":"hMailServer authorization bypass in COM administration API","severity":"high","exploited":false,"published_at":"2026-10-21T16:17:35.647+00:00","url":"https://junglewise.ai/threats/cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of"},{"cve":"CVE-2026-107571","cvss":7.8,"slug":"cve-2026-107571-incorrect-default-permissions-in-the-windows-installer-of","title":"hMailServer Windows installer privilege escalation via incorrect folder permissions","severity":"high","exploited":false,"published_at":"2026-10-19T16:17:01.97+00:00","url":"https://junglewise.ai/threats/cve-2026-107571-incorrect-default-permissions-in-the-windows-installer-of"},{"cve":"CVE-2026-126623","cvss":7.5,"slug":"cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of","title":"Progressive Robot hMailServer inefficient JSON parsing DoS","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.55+00:00","url":"https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of"},{"cve":"CVE-2026-126621","cvss":7.5,"slug":"cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows","title":"Progressive Robot hMailServer TLS file path traversal on Windows","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:14.277+00:00","url":"https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows"},{"cve":"CVE-2026-126613","cvss":7.5,"slug":"cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of","title":"Progressive Robot hMailServer JSON reader resource exhaustion","severity":"high","exploited":false,"published_at":"2026-11-11T09:17:13.267+00:00","url":"https://junglewise.ai/threats/cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of"}],"generated_at":"2026-11-11T10:07:00.224007+00:00"}