Overview
CVE-2026-126607 affects hMailServer from Progressive Robot, versions 6.2.3 through 6.3.7 on Windows, when configured with a MySQL or MariaDB database. It was published to the NVD on 2026-11-11 with a CVSS base score of 7.8 (High).
What the Advisory Says
Per the NVD description, hMailServer hands the bundled MariaDB Connector/C the folder holding its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes. The client then reads those bytes in the system's ANSI code page. When the two encodings disagree, the path the client resolves can differ from the path hMailServer intended.
The NVD text available at publication was truncated, so the full exploitation conditions and impact details are not confirmed here. Review the NVD entry for the complete description.
Technical Details
| Field | Value |
|---|---|
| CVE | CVE-2026-126607 |
| CVSS | 7.8 (High) |
| Product | hMailServer (Progressive Robot) |
| Affected | 6.2.3 through 6.3.7, Windows, MySQL or MariaDB backend |
| KEV status | Not known to be listed at time of writing |
Remediation
- Check whether your hMailServer instance runs a version from 6.2.3 through 6.3.7 against a MySQL or MariaDB database.
- Watch the project's release notes and the NVD entry for a fixed version, and upgrade when one is available.
- Restrict write access to the hMailServer installation directory, especially the
Binfolder and its plugin subfolder, to administrators only. - Use a built-in database backend or limit the service account's privileges where feasible until a fix is confirmed.