PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114479 Progressive Robot Ltd CVE debrief

A vulnerability in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows remote unauthenticated attackers to deliver infected messages to recipients' mailboxes unchanged when the server's virus scanner finds the message infected. This occurs because the server fails to securely handle the anti-virus attachment-stripping action, effectively failing open. The issue arises when the virus scanning action is set to remove attachments and deliver the text, which is the default action. Specifically, if a message consists of a single non-text part, such as a program, archive, or S/MIME message, the server cannot apply its stripping action and delivers the message as it arrived. Only a line in the application log indicates that the scanner found the content problematic.

Vendor
Progressive Robot Ltd
Product
hMailServer
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for email security, particularly those using hMailServer 6.0.0 through 6.3.6, should assess their exposure and verify if their configurations are vulnerable. This includes reviewing virus scanning settings and considering updates or additional security measures.

Why it matters

CVE-2026-114479 allows remote attackers to bypass hMailServer's virus scanning, potentially delivering infected messages. Defenders should verify exposure, review configurations, and consider updates to prevent potential undetected malicious content delivery.

  • Potential undetected delivery of malicious content to users
  • Bypass of virus scanning protections for certain message types
  • Need for verification of hMailServer configurations and versions
  • Possible increase in targeted attacks exploiting this vulnerability

Technical summary

The vulnerability in hMailServer allows remote unauthenticated attackers to deliver infected messages to recipients' mailboxes unchanged. This occurs because the server fails to securely handle its anti-virus attachment-stripping action. Specifically, if a message consists of a single non-text part, the server delivers it as is, with only a log entry indicating the scanner found problematic content.

Defensive priority

Defenders should prioritize verifying exposure in hMailServer deployments, especially those with virus scanning enabled and configured to remove attachments and deliver text. They should assess if any messages could have been delivered with malicious content undetected.

Recommended defensive actions

  • Verify hMailServer version and configuration to determine exposure
  • Review virus scanning settings and actions
  • Update to version 6.3.7 or later if possible
  • Monitor application logs for suspicious message handling
  • Consider implementing additional security measures for email content inspection

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor releases. However, there is limited information on actual exploitation or specific victim impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114479 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114479

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114479 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114479

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Not Failing Securely ('Failing Open') in hMailServer

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114479.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/hmailserver/hmailserver/-/work_items/92

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.