Progressive Robot hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener related to how failed CardDAV, CalDAV, or Autodiscover sign-ins from trusted proxies are counted. The listener counts failed sign-ins against the proxy's IP address rather than the actual client, potentially causing the proxy's address to be auto-banned from the server's mail listeners. This can result in denial of service for legitimate mail clients behind the proxy. The listener is off by default and uses HTTP Basic authentication over HTTPS for these services. The auto-ban feature is enabled by default, and no patch or fixed versions are explicitly stated.
CVE-2026-18767 is a vulnerability in TcRouter.sys that allows a local low privileged attacker or process to access I/O ports via exposed IOCTL function calls. This access can lead to a full compromise of the affected devices. The vulnerability has a high severity with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No affected versions or patch information is provided, and no known exploits are reported in the wild.
CVE-2026-126624 is a vulnerability in the Windows installer of Progressive Robot hMailServer 6.3.7 that allows a local authenticated user to execute code with elevated privileges. The issue arises when the installer installs or upgrades into a program folder where non-administrative users already have write permissions. Although version 6.3.7 hardened folder permissions for the program folder, Bin, and ControlPanel to restrict changes to administrators only, it does not change ownership or permissions of existing files or folders that other accounts control. This allows an attacker to place or maintain malicious binaries or scripts that run with elevated rights during installation or service execution. The default installation under Program Files is not affected.
Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 on Windows improperly handle TLS file names by passing them as Latin-1 bytes to OpenSSL, which interprets them as UTF-8. This mismatch allows a local attacker with file creation permissions to substitute TLS-related files, enabling unauthorized client certificate acceptance, interception and modification of stored messages, exposure of ACME client private keys, or denial of TLS port startup. The vulnerability requires non-default configurations such as non-ASCII file names and enabled client certificates. Linux builds are not affected.
CVE-2026-18768 is a vulnerability in TcRouter.sys that allows a local low privileged attacker to access arbitrary physical memory or define its mapping through exposed IOCTL function calls. This flaw can lead to a full compromise of affected devices. The vulnerability has a high severity score of 7.8 and does not require user interaction for exploitation.
Progressive Robot hMailServer versions 6.0.0-B1 through 6.2.18 have an SQL injection vulnerability in their database layer when using MySQL/MariaDB or PostgreSQL. This flaw allows remote attackers to alter SQL statements executed by the server, potentially leading to full compromise of the database contents and integrity. The vulnerability arises from improper parameter handling, enabling injection via message recipient addresses and certain message metadata. SQL Server and SQL Server Compact are not affected due to proper parameter binding.
A vulnerability in hMailServer versions 6.2.0 through 6.3.3 using MySQL or MariaDB databases allows an attacker to bypass the auto-ban mechanism after repeated failed login attempts. This occurs because the server's auto-ban feature fails to save IP ranges when usernames contain certain UTF-8 characters outside the Basic Multilingual Plane, preventing bans from being enforced. As a result, an unauthenticated remote attacker can continue guessing passwords from a single IP address without being banned. The issue affects authentication methods using SASL PLAIN and plain-text authentication under certain configurations. Failed attempts to save bans are logged as errors. The CVSS score is 5.3 (medium severity).
Progressive Robot hMailServer 6.3.7 on Windows has incorrect default permissions in its installer when installing into pre-existing folders writable by non-administrators. This flaw allows a local authenticated user to execute code with administrator privileges during setup or upgrade by placing malicious libraries in the Bin folder before permissions are hardened. The default installation under Program Files is not affected.
hMailServer versions 6.3.4 through 6.3.7, when configured with a MySQL or MariaDB database using TlsMode=verify-full but without specifying a TlsCaFile, do not properly verify the database server's certificate issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker who can impersonate the database server to intercept database credentials and manipulate traffic between hMailServer and the database. The issue arises because MariaDB Connector/C versions 3.4.1 and later accept any valid self-signed certificate without proper verification in these local connection scenarios. The default configuration is not affected as TlsMode defaults to prefer, which does not enforce certificate verification.
A vulnerability in the Windows installer of Progressive Robot hMailServer versions 6.0.0 through 6.3.7 allows a local authenticated user to execute code with elevated privileges. This occurs due to improper link resolution when the installation path includes junctions, symbolic links, or mount points controlled or modifiable by other users. The installer does not verify control of these links before installation, enabling attackers to redirect the installation to locations they control and execute code as the mail server's service account or administrator. The default installation path under Program Files is not affected. The fix for a related vulnerability (CVE-2026-107571) in version 6.3.7 does not address this issue fully.
A vulnerability in certain versions of Octopus Server allows users with limited permissions to bypass authorization checks and perform unauthorized actions such as running runbooks or creating deployments. This occurs due to incorrect validation of user permissions related to creating project triggers.
Progressive Robot hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener where it does not enforce the server's IP range restrictions. This allows remote unauthenticated attackers to continue guessing account passwords via the listener's sign-in interface even after their IP address has been banned by the auto-ban mechanism on other protocols. The listener is off by default and uses HTTP Basic authentication over HTTPS for CardDAV, CalDAV, and Outlook Autodiscover services. The auto-ban mechanism does not apply to this listener, enabling repeated failed login attempts from banned IPs or IPs restricted by administrator policies. The flaw is exacerbated when the listener is behind a TLS-terminating proxy, which causes bans to be ineffective because the listener sees only the proxy's IP address. A separate defect in per-account lockout was fixed in the same release. The CVSS score is 5.3 (medium severity).
A vulnerability in Progressive Robot hMailServer versions 6.2.25 through 6.3.7 on Windows affects configurations using a PostgreSQL database with certain SSL modes and root certificate file settings. The issue arises from how the root certificate file name is handled with Windows code pages and UTF-8 encoding, allowing a local attacker to cause hMailServer to trust a malicious certificate authority. This enables interception and modification of database traffic, including the database password. The vulnerability does not affect default configurations and is specific to Windows builds with PostgreSQL or Oracle MySQL client libraries replacing the bundled MariaDB Connector/C.
Progressive Robot hMailServer versions 6.3.4 through 6.3.7, when configured with a MySQL or MariaDB database and TlsMode=verify-full, improperly handle the CA file if its filename contains non-ASCII characters on Linux or characters above U+00FF on Windows. This causes the database client not to use the specified CA file for TLS verification, allowing an attacker who can intercept the database connection to read and modify traffic by presenting a certificate that bypasses proper validation. The vulnerability arises from the server converting the CA filename to an empty string under certain locale settings, resulting in no CA file being set without error, while certificate verification remains enabled. This issue is compounded by flaws in MariaDB Connector/C versions 3.4.2 to 3.4.10, which can accept unauthorized certificates under these conditions. The default hMailServer configuration is not affected as TlsMode defaults to prefer, which does not enforce certificate checks.
A resource exhaustion vulnerability exists in the JSON reader of Progressive Robot hMailServer versions 6.3.2 through 6.3.7. A remote attacker can send specially crafted JSON documents that cause excessive memory allocation and thread blocking, leading to denial of service affecting mail delivery, the REST API, and webmail functionality. The vulnerability allows unauthenticated access via TLS-RPT reports and certain REST API endpoints when enabled. This flaw is distinct from another JSON reader issue fixed in version 6.3.6.
hMailServer versions 6.2.22-pre2 through 6.3.7 have an authentication issue where account name comparisons by the database differ from the per-name lockout and compromised-account hold checks. This discrepancy allows remote unauthenticated attackers to bypass lockout thresholds by guessing passwords under different account name spellings. Additionally, accounts held for review can be accessed using alternate spellings with the correct password. The issue arises from how various databases handle case, accents, whitespace, and character width in account names, leading to multiple spellings of the same account with separate lockout thresholds.
A vulnerability in Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 causes the database layer to misinterpret failed SQL write statements as successful under certain conditions. This occurs due to improper handling of the [IGNORE-ERRORS] marker in SQL statements, leading to silent failures of database writes such as message deliveries, auto-ban entries, and message metadata. The flaw does not allow altering statement behavior or privilege escalation but can cause loss of data consistency and inaccurate server state reporting.
The Joinchat – Enhanced "click to chat" plugin for WordPress versions up to and including 6.3.1 is vulnerable to reflected cross-site scripting (XSS) via the '{HREF}' dynamic variable in query parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. Exploitation requires prior configuration of a telephone number and inclusion of the {HREF} variable in the Call-to-Action text.
Progressive Robot hMailServer versions 6.2.3 through 6.3.7 on Windows, when configured with a MySQL or MariaDB database, improperly handle the path to authentication plugins. This flaw allows a local authenticated user to execute code with the hMailServer service's privileges by exploiting how the plugin folder path is converted and loaded, especially when the installation path contains certain non-ASCII characters. Version 6.3.8 addresses these issues by properly handling plugin folder paths and restricting plugin loading to secure locations. Linux builds and default installations under ASCII-only paths are not affected.
Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 contain a vulnerability in the auto-ban mechanism that allows an attacker to bypass IP address banning after repeated failed login attempts. This flaw arises from how the server names and stores banned IP ranges based on usernames, leading to failures in saving bans when usernames are very long or contain certain characters such as NUL. Consequently, an attacker connecting from multiple IP addresses can continue guessing passwords over various protocols without being effectively banned.