CVE-2026-104659 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer deployments should assess exposure and prioritize upgrading to version 6.3.6 or later. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should verify affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Defenders should check

Why it matters

CVE-2026-104659 allows remote attackers to brute-force hMailServer administrator passwords via DNS rebinding, requiring defenders to verify versions and upgrade or implement compensating controls.

• Verify hMailServer version and upgrade to 6.3.6 or later if vulnerable to prevent password brute-forcing
• Implement throttling for failed administrator sign-ins to limit brute-force attempts
• Restrict access to the REST API listener to prevent unauthorized access

Technical summary

CVE-2026-104659 is an Origin Validation Error in hMailServer, allowing remote attackers to brute-force server administrator passwords via DNS rebinding due to missing Host header validation and throttling of failed administrator sign-ins in the REST API listener. The listener, off by default and bound to the loopback when enabled, answers requests regardless of the Host header. A web page can send authenticated requests to the listener, read the answers, and try administrator passwords at full speed until one is accepted. Defenders should prioritize verifying hMailServer versions and upgrading to 6.3.6 or later if vulnerable. They should also restrict access to the REST API listener and implement throttling for

Defensive priority

Defenders should prioritize verifying hMailServer versions and upgrading to 6.3.6 or later if vulnerable.

Recommended defensive actions

• Verify hMailServer version and upgrade to 6.3.6 or later if vulnerable
• Restrict access to the REST API listener
• Implement throttling for failed administrator sign-ins
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or affected systems. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessments. However, additional research is needed to verify affected scope, severity, and vendor guidance. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.