CVE-2026-104704 Progressive Robot Ltd CVE debrief

Who should care

Email administrators, security teams, and IT personnel responsible for managing hMailServer instances should assess their configurations and potential exposure to this vulnerability.

Why it matters

CVE-2026-104704 allows for cleartext transmission of sensitive information in hMailServer, impacting confidentiality and integrity of email communications. Email administrators and security teams should verify configurations, assess exposure, and consider updating to version 6.3.6 or later.

• Potential cleartext transmission of sensitive information.
• Possible interception or modification of email content.
• Need for verification of hMailServer configurations and versions.
• Potential impact on confidentiality and integrity of email communications.

Technical summary

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, allowing for cleartext transmission of sensitive information. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext.

Defensive priority

Email administrators and security teams should prioritize verifying hMailServer configurations, especially those handling sensitive information, and assess exposure to potential cleartext transmission of sensitive information.

Recommended defensive actions

• Verify hMailServer configurations to ensure proper TLS enforcement for outbound SMTP delivery.
• Assess exposure of sensitive information transmission in cleartext.
• Update to version 6.3.6 or later if possible.
• Monitor for potential anomalies in email transmission.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in hMailServer, but limited information is available on potential exploitation or affected versions beyond 6.0.0 through 6.3.5. The source details indicate that the server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published. Delivery to such a host fell back to opportunistic TLS, allowing an attacker with an active position on the network path between the server

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.