Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-126624— Unverified Ownership in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.3.7 的 Windows 安装程序存在未验证文件所有权的问题，允许本地已认证用户以邮件服务器服务账户或管理员身份执行代码。该问题发生在安装程序将软件安装到、或升级至一个非管理员账户此前已具有写入权限的程序文件夹时（例如，在驱动器根目录预先创建的文件夹）。 虽然 6.3.7 版本通过限制程序主目录、Bin 目录和 ControlPanel 目录的权限（仅允许管理员修改）修复了 CVE-2026-107571，但安装程序并未拒绝这些目录中已存在的文件，也

CVSS 7.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-126624

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unverified Ownership in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的属主
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.3.7 -

II. Public POCs for CVE-2026-126624

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-126624

请登录查看更多情报信息。

Vendor Pages for CVE-2026-126624 (1)

Other References for CVE-2026-126624 (2)

Same Patch Batch · Progressive Robot Ltd · 2026-11-11 · 18 CVEs total

CVE-2026-126617 8.8 HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in hM
CVE-2026-126607 7.8 HIGH Uncontrolled Search Path Element in hMailServer
CVE-2026-126612 7.8 HIGH Improper Link Resolution Before File Access ('Link Following') in hMailServer
CVE-2026-126613 7.5 HIGH Allocation of Resources Without Limits or Throttling in hMailServer
CVE-2026-126623 7.5 HIGH Inefficient Algorithmic Complexity in hMailServer
CVE-2026-126609 7.5 HIGH Improper Certificate Validation in hMailServer
CVE-2026-126621 7.5 HIGH Improper Certificate Validation in hMailServer
CVE-2026-126610 7.4 HIGH Improper Certificate Validation in hMailServer
CVE-2026-126622 7.3 HIGH Incorrect Default Permissions in hMailServer
CVE-2026-126611 7.0 HIGH Improper Certificate Validation in hMailServer
CVE-2026-126625 6.7 MEDIUM Incorrect Default Permissions in hMailServer
CVE-2026-126614 5.3 MEDIUM Improper Restriction of Excessive Authentication Attempts in hMailServer
CVE-2026-126626 5.3 MEDIUM Overly Restrictive Account Lockout Mechanism in hMailServer
CVE-2026-126615 5.3 MEDIUM Authentication Bypass by Alternate Name in hMailServer
CVE-2026-126616 5.3 MEDIUM Improper Restriction of Excessive Authentication Attempts in hMailServer
CVE-2026-126618 5.3 MEDIUM Improper Restriction of Excessive Authentication Attempts in hMailServer
CVE-2026-126619 4.8 MEDIUM Misinterpretation of Input in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-283