Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114479— Not Failing Securely ('Failing Open') in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.0.0 至 6.3.6 版本在反病毒“剥离附件”操作中未能安全地处理失败情况，使得远程未认证攻击者能够将病毒扫描器已判定为受感染的邮件以原始形式投递至收件人邮箱。当启用病毒扫描并将动作设置为“移除附件并投递文本内容”（默认动作为删除整封邮件）时，服务器会保留受感染邮件中的一个文本部分，并将所有附件替换为提示说明。然而，若邮件仅包含非文本部分（例如：将整个程序或归档文件作为邮件正文发送、以完整形式承载的邮件、被声明为附件的文件，或作为单一部分进行 S/M

CVSS 5.8 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.0.0≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114479

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Not Failing Securely ('Failing Open') in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未能安全地进行程序失效(Failing Open)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.0.0 ~ 6.3.6 -

II. Public POCs for CVE-2026-114479

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114479

请登录查看更多情报信息。

Vendor Pages for CVE-2026-114479 (2)

Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total

CVE-2026-114489 8.1 HIGH Missing Authorization in hMailServer
CVE-2026-114490 7.8 HIGH Incorrect Authorization in hMailServer
CVE-2026-114476 7.5 HIGH Incorrect Authorization in hMailServer
CVE-2026-114475 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-114478 5.9 MEDIUM Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
CVE-2026-114474 5.9 MEDIUM Use of Less Trusted Source in hMailServer
CVE-2026-114470 5.3 MEDIUM Cross-Site Request Forgery (CSRF) in hMailServer
CVE-2026-114473 5.0 MEDIUM Incorrect Authorization in hMailServer
CVE-2026-114471 4.7 MEDIUM Insertion of Sensitive Information into Log File in hMailServer
CVE-2026-114477 4.3 MEDIUM Missing Authorization in hMailServer
CVE-2026-114472 3.7 LOW Insufficient Resource Pool in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-636

V. Comments for CVE-2026-114479

No comments yet

Leave a comment