Progressive Robot hMailServer: Local privilege escalation via installer (CVE-2026-126612)
The Windows installer for Progressive Robot hMailServer versions 6.0.0 through 6.3.7 is vulnerable to improper link resolution, allowing a local authenticated user to run code as the mail server's service account or as an administrator.
CVE search metadata
CVE search record: CVE-2026-126612. Severity: high. CVSS: 7.8. KEV: no. Product: hMailServer 6.0.0 through 6.3.7 (6.0.0-6.3.7). Brief: Progressive Robot hMailServer: Local privilege escalation via installer (CVE-2026-126612). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hmailserver-priv-esc-cve-2026-126612/
Triage facts
Revision 1- Applicability
- hMailServer 6.0.0 through 6.3.7 (6.0.0-6.3.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 14:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progressive Robot hMailServer 6.0.0 through 6.3.7 contains a vulnerability in the Windows installer where the program performs improper link resolution. This allows a local authenticated user to run code as the mail server's service account or as an administrator by utilizing junctions, symbolic links, or mount points. The service, which runs as LocalSystem or as its virtual account, starts programs from the path provided to the installer. Default installations under Program Files are not affected.