{"id":"CVE-2026-126612","kind":"vulnerability","aliases":["CVE-2026-126612"],"related":[],"title":"hMailServer Windows installer follows links, enabling local privilege escalation to admin","description":"Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.","summary":"The Windows installer for hMailServer 6.0.0 through 6.3.7 follows junctions, symbolic links or mount points in the program folder path without checking who controls them. A local authenticated user can redirect installed programs into a folder they control, so the mail server service (LocalSystem or its virtual account) and programs administrators run from Bin execute attacker code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","package","windows"],"not_affected_if":["default-config","program-files-install"],"how_to_check":"- Check the installed hMailServer version in the hMailServer program folder or Add/Remove Programs, and compare it with `6.3.7` and the affected range `6.0.0` through `6.3.7`.\n- Check whether the install path is under Program Files; the sources say the default installation under Program Files is not affected.\n- Check whether the install path or any parent folder is a junction, symbolic link or mount point, for example with `dir /AL` or `fsutil reparsepoint query`, and whether non-admin users can rename parent folders.","fix":"- hMailServer `6.3.7` or later is referenced as the earlier fix for CVE-2026-107571, which the sources say does not cover this issue; no fixed version for this CVE is stated in the sources.","status":"open","published_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:25+00:00","updated_at":"2026-11-11T09:28:25+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T09:28:25Z","model":"claude-haiku-5-5","output":{"fix":"- hMailServer `6.3.7` or later is referenced as the earlier fix for CVE-2026-107571, which the sources say does not cover this issue; no fixed version for this CVE is stated in the sources.","reach":"local","title":"hMailServer Windows installer follows links, enabling local privilege escalation to admin","impact":"high","summary":"The Windows installer for hMailServer 6.0.0 through 6.3.7 follows junctions, symbolic links or mount points in the program folder path without checking who controls them. A local authenticated user can redirect installed programs into a folder they control, so the mail server service (LocalSystem or its virtual account) and programs administrators run from Bin execute attacker code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","windows","mail-server"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains LocalSystem or administrator code execution on the mail server","analyst_note":"Confirm the fixed version for CVE-2026-126612 from the vendor advisory or NVD; the sources do not state one.","how_to_check":"- Check the installed hMailServer version in the hMailServer program folder or Add/Remove Programs, and compare it with `6.3.7` and the affected range `6.0.0` through `6.3.7`.\n- Check whether the install path is under Program Files; the sources say the default installation under Program Files is not affected.\n- Check whether the install path or any parent folder is a junction, symbolic link or mount point, for example with `dir /AL` or `fsutil reparsepoint query`, and whether non-admin users can rename parent folders.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","program-files-install"],"who_is_affected":"Systems running hMailServer 6.0.0 through 6.3.7 on Windows where the install path passes through a link or a renameable folder, typically a non-default install location. The default Program Files installation is stated not to be affected, and the sources say the 6.3.7 hardening does not cover this path. Attacker needs a local account on the machine.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000873,"input_tokens":4850,"output_tokens":776,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107571':260C '-126612':14A,17A '-2026':13A,16A,259C '6.0.0':29B,92C '6.3.7':31B,94C,254C 'account':71B,109C,214C,219C,241C 'admin':11A 'administr':74B,113C,245C,285C 'affect':323C 'afterward':307C 'allow':95C 'alon':288C 'anoth':213C 'attack':79B 'authent':51B,98C 'bin':77B,248C,271C 'chang':141C,276C 'check':45B,178C 'code':80B,102C 'control':47B,61B,135C,180C,215C,230C,289C 'controlpanel':273C 'could':311C 'cover':263C 'cve':12A,15A,258C 'default':316C 'drive':152C 'enabl':6A 'escal':9A 'everi':138C,164C 'execut':78B 'file':320C 'first':177C 'fix':256C 'folder':42B,59B,120C,162C,185C,189C,228C,270C,278C,310C 'follow':4A,32B 'harden':266C,314C 'hmailserv':1A,18B,28B,91C 'improp':81C 'instal':3A,26B,55B,87C,169C,209C,299C,317C 'junction':33B,124C,145C 'later':221C 'lead':216C,225C 'link':5A,35B,82C,127C,175C,212C,282C,302C 'local':7A,50B,97C 'localsystem':67B,236C 'made':146C 'mail':20B,64B,105C 'mail-serv':19B 'make':222C 'may':140C,166C,190C 'mount':37B,130C 'packag':22B 'pass':121C 'path':43B,116C,204C,224C,297C 'permiss':158C 'point':38B,131C 'privileg':8A 'program':41B,56B,73B,119C,171C,188C,201C,207C,244C,269C,319C 'progress':89C 'reach':279C 'redirect':54B 'refus':294C 'regist':197C 'renam':167C,192C 'report':306C 'resolut':83C 'robot':90C 'root':149C,156C 'run':75B,101C,199C,234C,246C 'server':21B,65B,106C 'servic':66B,108C,195C,232C 'setup':168C,291C 'start':251C 'symbol':34B,126C 'take':154C 'user':52B,99C,134C,139C,165C 'virtual':70B,240C 'whether':183C 'window':2A,23B,25B,86C 'without':44B,176C","nicknames":[],"mitigations":[],"who_affected":"Systems running hMailServer 6.0.0 through 6.3.7 on Windows where the install path passes through a link or a renameable folder, typically a non-default install location. The default Program Files installation is stated not to be affected, and the sources say the 6.3.7 hardening does not cover this path. Attacker needs a local account on the machine.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hmailserver","mailserver","package","windows"],"campaign_type":null,"search_a":"'-126612':14A,17A '-2026':13A,16A 'admin':11A 'cve':12A,15A 'enabl':6A 'escal':9A 'follow':4A 'hmailserv':1A 'instal':3A 'link':5A 'local':7A 'privileg':8A 'window':2A","search_b":"'6.0.0':29B '6.3.7':31B 'account':71B 'administr':74B 'attack':79B 'authent':51B 'bin':77B 'check':45B 'code':80B 'control':47B,61B 'execut':78B 'folder':42B,59B 'follow':32B 'hmailserv':18B,28B 'instal':26B,55B 'junction':33B 'link':35B 'local':50B 'localsystem':67B 'mail':20B,64B 'mail-serv':19B 'mount':37B 'packag':22B 'path':43B 'point':38B 'program':41B,56B,73B 'redirect':54B 'run':75B 'server':21B,65B 'servic':66B 'symbol':34B 'user':52B 'virtual':70B 'window':23B,25B 'without':44B","search_c":"'-107571':260C '-2026':259C '6.0.0':92C '6.3.7':94C,254C 'account':109C,214C,219C,241C 'administr':113C,245C,285C 'affect':323C 'afterward':307C 'allow':95C 'alon':288C 'anoth':213C 'authent':98C 'bin':248C,271C 'chang':141C,276C 'check':178C 'code':102C 'control':135C,180C,215C,230C,289C 'controlpanel':273C 'could':311C 'cover':263C 'cve':258C 'default':316C 'drive':152C 'everi':138C,164C 'file':320C 'first':177C 'fix':256C 'folder':120C,162C,185C,189C,228C,270C,278C,310C 'harden':266C,314C 'hmailserv':91C 'improp':81C 'instal':87C,169C,209C,299C,317C 'junction':124C,145C 'later':221C 'lead':216C,225C 'link':82C,127C,175C,212C,282C,302C 'local':97C 'localsystem':236C 'made':146C 'mail':105C 'make':222C 'may':140C,166C,190C 'mount':130C 'pass':121C 'path':116C,204C,224C,297C 'permiss':158C 'point':131C 'program':119C,171C,188C,201C,207C,244C,269C,319C 'progress':89C 'reach':279C 'refus':294C 'regist':197C 'renam':167C,192C 'report':306C 'resolut':83C 'robot':90C 'root':149C,156C 'run':101C,199C,234C,246C 'server':106C 'servic':108C,195C,232C 'setup':168C,291C 'start':251C 'symbol':126C 'take':154C 'user':99C,134C,139C,165C 'virtual':240C 'whether':183C 'window':86C 'without':176C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126612","severity":null,"published_at":"2026-11-11T09:17:13+00:00","modified_at":"2026-11-11T09:17:13+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}