CVE-2026-126612

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.

• CWE-59

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
• https://gitlab.com/hmailserver/hmailserver/-/work_items/78
• https://www.cve.org/CVERecord?id=CVE-2026-107571

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12660IBM MQ Web Console could allow an authenticated administrato…2.7
• CVE-2026-126607Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows…7.8
• CVE-2026-126609Progressive Robot hMailServer 6.2.25 through 6.3.7 on Window…7.5
• CVE-2026-12661A denial-of-service security issue exists within FactoryTalk…4.8
• CVE-2026-126610Progressive Robot hMailServer 6.3.4 through 6.3.7, with a My…7.4
• CVE-2026-126611Progressive Robot hMailServer 6.3.4 through 6.3.7, with a My…7
• CVE-2026-126613Allocation of resources without limits in the JSON reader of…7.5
• CVE-2026-126614The web services listener of Progressive Robot hMailServer 6…5.3
• CVE-2026-126615The sign-in of Progressive Robot hMailServer 6.2.22-pre2 thr…5.3
• CVE-2026-126616The auto-ban of Progressive Robot hMailServer 6.2.0 through …5.3
• CVE-2026-126617SQL injection in the database layer of Progressive Robot hMa…8.8
• CVE-2026-126618The auto-ban of Progressive Robot hMailServer 6.0.0-B1 throu…5.3