CVE-2026-104658 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer installations, especially those running on Linux, should assess exposure and prioritize verification of the service account's privileges and the integrity of their installations.

Why it matters

Defenders should prioritize verifying the integrity of hMailServer installations, especially those running on Linux, and ensure that the service account's privileges are properly restricted to prevent potential privilege escalation and arbitrary code execution.

• Potential for privilege escalation from the hmailserver service account to root
• Possible execution of arbitrary code as root on affected Linux installations
• Risk of compromise of hMailServer installations if the service account is already compromised

Technical summary

The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account. An attacker who already runs code as the hmailserver service account can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.

Defensive priority

Defenders should prioritize verifying the integrity of hMailServer installations, especially those running on Linux, and ensure that the service account's privileges are properly restricted.

Recommended defensive actions

• Verify the integrity of hMailServer installations, especially those running on Linux
• Ensure that the service account's privileges are properly restricted
• Monitor for suspicious activity related to the hmailserver service account
• Consider upgrading to version 6.3.6 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score of 7.8 and the affected versions of hMailServer (6.3.4 and 6.3.5). The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer runs as root on a request file written by the unprivileged hmailserver service account. The live update's path unit is active by default for .deb and .rpm packages, and on AppImage installations run under that unit. Defenders should verify the service account's privileges and the integrity

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.