hMailServer 6.3.4 Fixes Pre-Authentication Script Injection
Tech GuruQuick Answer
Progressive Robot Ltd released hMailServer 6.3.4 to fix CVE-2026-100741, a Critical script-injection flaw affecting 6.0.0 through 6.3.3. Prioritize Windows servers with event scripting and JScript, validate the exact handlers and rule permissions, and perform the vendor's manual 6.3.4 upgrade after a tested database and data backup.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory hMailServer 6.0.0–6.3.3 systems, identify Windows event scripting, JScript, affected handlers, externally reachable mail and sign-in services, and rule editors; disable the exposed scripting paths if necessary, then back up and manually install 6.3.4 with planned database migration and recovery validation.
Last verified: 2026-09-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | hMailServer 6.0.0 through 6.3.3 on Windows under the vendor's event-script conditions |
|---|---|
| Advisory | hMailServer 6.3.4 |
| CVE | CVE-2026-100741 |
| Authoritative release date | 2026-09-27 02:37:56.400 UTC (GitLab release timestamp) |
| Authority revision date | No separate authority revision date published; verified against the 2026-09-27 GitLab release and CNA record |
| Affected versions | hMailServer 6.0.0 through 6.3.3. The remote unauthenticated password, POP3 UID, and delivery-error paths require Windows event scripting, JScript, and a relevant handler; the rule Run-function path can involve either scripting language. |
| Fixed version | hMailServer 6.3.4 |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Progressive Robot Ltd fixed an evaluation-injection flaw that can let unauthenticated network input execute script inside hMailServer.exe in qualifying Windows JScript event-handler configurations. The GitLab CNA rates CVE-2026-100741 Critical at 9.8; the vendor release also documents a rule Run-function path.
What To Validate Now
- Inventory. Locate hMailServer 6.0.0 through 6.3.3, record operating system, event-scripting state and language, OnClientValidatePassword, OnExternalAccountDownload and OnDeliveryFailed handlers, rule Run-function permissions, service account, exposed POP3/SMTP/sign-in paths, database engine, data store, and owner.
- Establish applicability. Match the CNA range and vendor conditions exactly. The vendor says the password, POP3 UID, and delivery-error paths did not expose VBScript servers and that Linux builds had no script engine; it separately says a rule Run-function name reached the flaw in either scripting language.
- Remediate. Back up the database and data directory, validate restore readiness, and manually install hMailServer 6.3.4 from the vendor's GitLab release. Until upgrade, disable event scripting or remove the three named handlers and restrict rule creation or editing as directed by the vendor.
- Validate. Verify the installer Authenticode signature and published checksum/signature material, confirm version 6.3.4, complete and record the one-way schema 6040-to-6104 migration, reload and test mail flow and event scripts, confirm rule permissions, and monitor application and database logs.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The vendor says live update will not install 6.3.4. The database migration has 64 one-way steps and may be lengthy on large stores, with database-version, privilege, and collation constraints. Test backup restoration and rollback boundaries before change; preserve the original configuration and scripts; do not infer exploitation from the Critical score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
