---
id: "CVE-2026-126612"
page: "https://infrastack.ai/live/CVE-2026-126612"
kind: "vulnerability"
aliases: ["CVE-2026-126612"]
title: "hMailServer Windows installer follows links, enabling local privilege escalation to admin"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hmailserver", "mail-server", "package", "windows"]
not_affected_if: ["default-config", "program-files-install"]
published_at: "2026-11-11T09:17:13+00:00"
first_seen_at: "2026-11-11T09:26:48+00:00"
updated_at: "2026-11-11T09:28:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126612", "first_seen_at": "2026-11-11T09:26:48+00:00"}]
exploit_sources: []
---

# hMailServer Windows installer follows links, enabling local privilege escalation to admin

Link for people: https://infrastack.ai/live/CVE-2026-126612 (this .md is for agents)

The Windows installer for hMailServer 6.0.0 through 6.3.7 follows junctions, symbolic links or mount points in the program folder path without checking who controls them. A local authenticated user can redirect installed programs into a folder they control, so the mail server service (LocalSystem or its virtual account) and programs administrators run from Bin execute attacker code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed hMailServer version in the hMailServer program folder or Add/Remove Programs, and compare it with `6.3.7` and the affected range `6.0.0` through `6.3.7`.
- Check whether the install path is under Program Files; the sources say the default installation under Program Files is not affected.
- Check whether the install path or any parent folder is a junction, symbolic link or mount point, for example with `dir /AL` or `fsutil reparsepoint query`, and whether non-admin users can rename parent folders.

## Fix

- hMailServer `6.3.7` or later is referenced as the earlier fix for CVE-2026-107571, which the sources say does not cover this issue; no fixed version for this CVE is stated in the sources.

## Timeline

- 2026-11-11T09:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126612

## From the sources

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_