# Progressive Robot vulnerabilities Source: https://junglewise.ai/threats/vendors/progressive-robot Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/progressive-robot.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in Progressive Robot: 18 in the last 7 days and 34 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126626, was published on 11 November 2026. 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 18 - Last 30 days: 33 - Last 90 days: 34 - All time: 34 (1 critical, 0 exploited in the wild) ## About Progressive Robot Open-source tool for automating repetitive tasks and managing robotic process automation workflows. ## Latest Progressive Robot vulnerabilities - [CVE-2026-126626: Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-126625: hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of) (medium, CVSS 6.7, published 11 Nov 2026) - [CVE-2026-126624: hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive) (high, CVSS 7.3, published 11 Nov 2026) - [CVE-2026-126623: Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126622: Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of) (high, CVSS 7.3, published 11 Nov 2026) - [CVE-2026-126621: Progressive Robot hMailServer TLS file path traversal on Windows](https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126619: Progressive Robot hMailServer SQL statement misinterpretation](https://junglewise.ai/threats/cve-2026-126619-misinterpretation-of-sql-statement-text-in-the-database-layer-of) (medium, CVSS 4.8, published 11 Nov 2026) - [CVE-2026-126618: hMailServer account password brute-force via auto-ban bypass](https://junglewise.ai/threats/cve-2026-126618-the-auto-ban-of-progressive-robot-hmailserver-6-0-0-b1-through-6) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-126617: Progressive Robot hMailServer SQL injection in database layer](https://junglewise.ai/threats/cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-126616: hMailServer auto-ban bypass via UTF-8 character handling](https://junglewise.ai/threats/cve-2026-126616-the-auto-ban-of-progressive-robot-hmailserver-6-2-0-through-6-3) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-126615: Progressive Robot hMailServer authentication bypass and lockout evasion](https://junglewise.ai/threats/cve-2026-126615-the-sign-in-of-progressive-robot-hmailserver-6-2-22-pre2-through) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-126614: Progressive Robot hMailServer IP ranges bypass in web services listener](https://junglewise.ai/threats/cve-2026-126614-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-126613: Progressive Robot hMailServer JSON reader resource exhaustion](https://junglewise.ai/threats/cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126612: Progressive Robot hMailServer privilege escalation in Windows installer](https://junglewise.ai/threats/cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-126611: Progressive Robot hMailServer TLS certificate verification bypass](https://junglewise.ai/threats/cve-2026-126611-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql) (high, CVSS 7, published 11 Nov 2026) - [CVE-2026-126610: Progressive Robot hMailServer TLS CA file bypass](https://junglewise.ai/threats/cve-2026-126610-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql) (high, CVSS 7.4, published 11 Nov 2026) - [CVE-2026-126609: hMailServer TLS certificate validation bypass on Windows with PostgreSQL](https://junglewise.ai/threats/cve-2026-126609-progressive-robot-hmailserver-6-2-25-through-6-3-7-on-windows) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126607: Progressive Robot hMailServer path traversal in MariaDB Connector plugin loading](https://junglewise.ai/threats/cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-114490: hMailServer authorization bypass in COM administration API](https://junglewise.ai/threats/cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of) (high, CVSS 7.8, published 21 Oct 2026) - [CVE-2026-114489: Progressive Robot hMailServer missing authorization in REST and COM administration APIs](https://junglewise.ai/threats/cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114479: Progressive Robot hMailServer anti-virus attachment-stripping failure](https://junglewise.ai/threats/cve-2026-114479-not-failing-securely-in-the-anti-virus-attachment-stripping) (medium, CVSS 5.8, published 21 Oct 2026) - [CVE-2026-114477: Progressive Robot hMailServer missing authorization in REST metrics route](https://junglewise.ai/threats/cve-2026-114477-missing-authorization-in-the-rest-metrics-route-of-progressive) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-114476: hMailServer REST API authorization bypass in role management](https://junglewise.ai/threats/cve-2026-114476-incorrect-authorization-in-the-rest-administration-api-of) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-114475: Progressive Robot hMailServer REST authorization bypass in role management](https://junglewise.ai/threats/cve-2026-114475-missing-authorization-in-the-rest-role-management-routes-of) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114474: hMailServer SPF/DMARC bypass via external account forwarding](https://junglewise.ai/threats/cve-2026-114474-use-of-a-less-trusted-source-for-the-envelope-sender-in-the) (medium, CVSS 5.9, published 21 Oct 2026) ## Most severe Progressive Robot vulnerabilities - [CVE-2026-100741: Progressive Robot hMailServer code injection in JScript event dispatcher](https://junglewise.ai/threats/cve-2026-100741-eval-injection-in-the-jscript-event-script-dispatcher-in) (critical, CVSS 9.8, published 27 Sep 2026) - [CVE-2026-126617: Progressive Robot hMailServer SQL injection in database layer](https://junglewise.ai/threats/cve-2026-126617-sql-injection-in-the-database-layer-of-progressive-robot) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-114489: Progressive Robot hMailServer missing authorization in REST and COM administration APIs](https://junglewise.ai/threats/cve-2026-114489-missing-authorization-in-the-rest-and-com-administration-apis-of) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-126612: Progressive Robot hMailServer privilege escalation in Windows installer](https://junglewise.ai/threats/cve-2026-126612-improper-link-resolution-in-the-windows-installer-of-progressive) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-126607: Progressive Robot hMailServer path traversal in MariaDB Connector plugin loading](https://junglewise.ai/threats/cve-2026-126607-progressive-robot-hmailserver-6-2-3-through-6-3-7-on-windows) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-114490: hMailServer authorization bypass in COM administration API](https://junglewise.ai/threats/cve-2026-114490-incorrect-authorization-in-the-com-administration-api-of) (high, CVSS 7.8, published 21 Oct 2026) - [CVE-2026-107571: hMailServer Windows installer privilege escalation via incorrect folder permissions](https://junglewise.ai/threats/cve-2026-107571-incorrect-default-permissions-in-the-windows-installer-of) (high, CVSS 7.8, published 19 Oct 2026) - [CVE-2026-126623: Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126621: Progressive Robot hMailServer TLS file path traversal on Windows](https://junglewise.ai/threats/cve-2026-126621-progressive-robot-hmailserver-6-0-0-b1-through-6-3-7-on-windows) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126613: Progressive Robot hMailServer JSON reader resource exhaustion](https://junglewise.ai/threats/cve-2026-126613-allocation-of-resources-without-limits-in-the-json-reader-of) (high, CVSS 7.5, published 11 Nov 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 15 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 18 | 0 | 0 | ## Progressive Robot technologies - [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver): 34 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progressive Robot vulnerabilities", https://junglewise.ai/threats/vendors/progressive-robot, 12 November 2026.