Fail-open anti-virus action delivers infected mail in hMailServer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Progressive Robot hMailServer from 6.0.0 through 6.3.6 fails open in its anti-virus attachment-stripping action (CWE-636). With virus scanning set to remove attachments and deliver the text, a message whose single part is a program, an archive, or another non-text part is delivered unchanged to the recipient's mailbox, with the infected content intact. A remote unauthenticated attacker can send such a message, and the only trace is a line in the application log.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 – 6.3.6 | — | No fix listed | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.0.0 – 6.3.6 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for hMailServer.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114479
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: MEDIUM → LOW
- 2026-10-21 Alias added: GHSA-c5hp-vrp8-f5pg
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
Sources
- CVE-2026-114479 · CVE Program
- CVE-2026-114479 · NVD
- FIRST EPSS
- GHSA-c5hp-vrp8-f5pg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences