{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/progressive-robot/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progressiverobot:hmailserver:6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:progressiverobot:hmailserver:6.3.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-107567"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["hMailServer (6.0.0 through 6.3.6)","hMailServer (6.0.0-6.3.6)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","email-server","cve","privilege-escalation","windows","local-exploitation"],"_cs_type":"advisory","_cs_vendors":["Progressive Robot"],"content_html":"\u003cp\u003eProgressive Robot hMailServer versions 6.0.0 through 6.3.6 suffer from a critical flaw in their DKIM signing implementation. When DKIM signing is enabled for a hosted domain, the mail server applies a cryptographic signature to all outgoing messages based on the 'From' header, prior to verifying the authenticity of the sender. This logic applies to any inbound message, including those submitted by unauthenticated remote sources.\u003c/p\u003e\n\u003cp\u003eAn attacker can craft an email with an arbitrary 'From' address belonging to a domain hosted by the vulnerable server. The server, failing to perform sender verification before the signature process, cryptographically signs the malicious message using the domain's private DKIM key. If the mail server is configured with forwarding rules, aliases, distribution lists, or Sieve redirects that result in the message being relayed to external recipients, the forged message will pass DKIM and DMARC alignment checks, significantly increasing the probability of successful phishing and social engineering attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target organization using a vulnerable version of hMailServer (6.0.0 - 6.3.6) with DKIM signing enabled.\u003c/li\u003e\n\u003cli\u003eAttacker confirms the target domain utilizes forwarding, aliases, or distribution lists that relay mail to external addresses.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious email via SMTP to the hMailServer, setting the 'From' header to a spoofed address within the target domain.\u003c/li\u003e\n\u003cli\u003ehMailServer receives the inbound message and performs the DKIM signing process based solely on the unverified 'From' header.\u003c/li\u003e\n\u003cli\u003eThe server appends a valid cryptographic signature corresponding to the target domain’s DKIM key to the malicious email.\u003c/li\u003e\n\u003cli\u003eThe server processes the email through its configured routing (e.g., mail rule or forward) and relays the signed, forged message to an external recipient.\u003c/li\u003e\n\u003cli\u003eThe external recipient's mail infrastructure performs SPF/DKIM/DMARC validation, which passes successfully due to the valid (but forged) signature.\u003c/li\u003e\n\u003cli\u003eRecipient consumes the phishing email, resulting in unauthorized access or credential theft.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation enables attackers to bypass email authentication mechanisms, allowing them to send highly credible phishing emails that appear to originate from legitimate domains hosted on the affected infrastructure. This facilitates business email compromise (BEC), credential theft, and the distribution of malicious payloads to external users. The vulnerability impacts organizations relying on hMailServer for mail delivery, specifically those utilizing automated forwarding or external aliases.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately: Upgrade hMailServer to a version beyond 6.3.6 that implements sender authentication prior to the DKIM signing process.\u003c/li\u003e\n\u003cli\u003eConfiguration mitigation: If an immediate upgrade is not possible, disable DKIM signing for domains that utilize forwarding, aliases, or distribution lists that relay mail externally, until the patch is applied.\u003c/li\u003e\n\u003cli\u003eSecurity policy: Enable 'SmtpAuthenticatedSenderCheck' in the hMailServer configuration to force authentication checks on envelope addresses, though this does not fully mitigate the risk of signing forgeries based on the 'From' header.\u003c/li\u003e\n\u003cli\u003eMonitoring: Monitor email logs for unusual spikes in forwarded messages or relay activity originating from unauthenticated sources that utilize domain-specific DKIM keys.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T18:09:33Z","date_published":"2026-10-19T18:09:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hmailserver-dkim-spoof/","summary":"Progressive Robot hMailServer 6.0.0 through 6.3.6 contains a vulnerability allowing unauthenticated remote attackers to forge DKIM-signed emails for hosted domains via improper verification of sender identity during the signing process.","title":"DKIM Signature Forgery Vulnerability in hMailServer","url":"https://feed.craftedsignal.io/briefs/2026-10-hmailserver-dkim-spoof/"}],"language":"en","title":"CraftedSignal Threat Feed - Progressive Robot","version":"https://jsonfeed.org/version/1.1"}