---
id: "CVE-2026-126622"
page: "https://infrastack.ai/live/CVE-2026-126622"
kind: "vulnerability"
aliases: ["CVE-2026-126622"]
title: "hMailServer: Windows installer lets local users run code as admin"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hmailserver", "package", "self-hosted", "windows"]
not_affected_if: ["default-install-path", "managed-hosting"]
published_at: "2026-11-11T09:17:14+00:00"
first_seen_at: "2026-11-11T09:26:48+00:00"
updated_at: "2026-11-11T09:28:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126622", "first_seen_at": "2026-11-11T09:26:48+00:00"}]
exploit_sources: []
---

# hMailServer: Windows installer lets local users run code as admin

Link for people: https://infrastack.ai/live/CVE-2026-126622 (this .md is for agents)

The Windows installer of hMailServer 6.3.7 sets default permissions that let a local user who can write to an existing install folder plant a library that setup then runs with administrator rights. An attacker who is already logged in on the machine can get code running as the administrator who runs setup.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed hMailServer version and the folder it was installed into, such as `C:\Program Files\hMailServer` for the default location; a folder created at the root of a drive that ordinary users can write to is the affected case.
- Inspect the write permissions on the install folder and its `Bin` and `ControlPanel` subfolders for non-administrator accounts.

## Fix

- hMailServer 6.3.7 is the affected release; the sources do not name a fixed version for this CVE.

## Timeline

- 2026-11-11T09:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126622

## From the sources

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_