https://feed.craftedsignal.io/products/hmailserver-6.0.0-through-6.3.7-6.0.0-6.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 14:03:52 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-priv-esc-cve-2026-126612/Wed, 11 Nov 2026 14:03:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hmailserver-priv-esc-cve-2026-126612/The Windows installer for Progressive Robot hMailServer versions 6.0.0 through 6.3.7 is vulnerable to improper link resolution, allowing a local authenticated user to run code as the mail server's service account or as an administrator.<p>Progressive Robot hMailServer 6.0.0 through 6.3.7 contains a vulnerability in the Windows installer where the program performs improper link resolution. This allows a local authenticated user to run code as the mail server's service account or as an administrator by utilizing junctions, symbolic links, or mount points. The service, which runs as LocalSystem or as its virtual account, starts programs from the path provided to the installer. Default installations under Program Files are not affected.</p> highadvisory