Progressive Robot hMailServer: Local privilege escalation (CVE-2026-126622)
The Windows installer for Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the administrator performing setup, upgrade, or repair, when installed into a pre-existing directory that is writable by non-administrators.
CVE search metadata
CVE search record: CVE-2026-126622. Severity: high. CVSS: 7.3. KEV: no. Product: hMailServer 6.3.7. Brief: Progressive Robot hMailServer: Local privilege escalation (CVE-2026-126622). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hmailserver-privilege-escalation-cve-2026-126622/
Triage facts
Revision 1- Applicability
- hMailServer 6.3.7
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Windows installer for Progressive Robot hMailServer 6.3.7 contains a vulnerability involving incorrect default permissions. When the server is installed, upgraded, or repaired into a pre-existing folder that is writable by non-administrators, the installer copies programs into a 'Bin' folder and executes them with administrator rights before hardening the folder permissions. An authenticated user can place a library in the 'Bin' folder during this window, causing the system to load the malicious library instead of the legitimate one. The default installation under 'Program Files' is not affected.