CVE-2026-114479: CWE-636: Not Failing Securely ('Failing Open') in Progressive Robot Ltd hMailServer

CVE-2026-114479 is a failing secure vulnerability (CWE-636) in Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6. The issue occurs in the anti-virus attachment-stripping feature when virus scanning is enabled and configured to remove attachments and deliver the text portion of messages. For messages that are not multipart text (e.g., single-part executables, archives, or S/MIME signed messages), the server cannot isolate and remove infected parts and instead delivers the entire infected message unchanged. This behavior allows an unauthenticated remote attacker to bypass virus scanning and deliver infected content to recipients.

The vulnerability allows remote unauthenticated attackers to send infected messages that bypass the server's virus scanning removal process and are delivered unchanged to recipients. This could lead to recipients receiving malicious attachments or content that the server's virus scanner flagged but failed to remove. There is no confidentiality or availability impact reported, and the integrity impact is limited to the delivery of infected messages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the attachment-stripping feature or configuring virus scanning actions to delete infected messages rather than attempting to remove attachments and deliver text. Monitoring application logs for infection notices can help detect attempted exploitation, but this does not prevent delivery of infected single-part messages.