hMailServer 6.3.4 Fixes Pre-Authentication Script Injection
Tech GuruQuick Answer
hMailServer 6.3.4 fixes script injection in the listed Windows 6.0.0-6.3.3 configurations. Check event scripting, language, handlers, and rule-edit permissions before deciding applicability. This release requires manual installation and a planned database migration, not just a live-update check.
Confirm Scope And Apply The Supported Fix
Next step: Reopen the vendor release instructions and verify the installer before changing a server. Test a database-and-mail-data restore first; preserve relevant logs and scripts if unauthorized activity is suspected.
Last verified: 2026-09-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | hMailServer 6.0.0 through 6.3.3 on Windows under the vendor's event-script conditions |
|---|---|
| Advisory | hMailServer 6.3.4 |
| CVE | CVE-2026-100741 |
| Authoritative release date | 2026-09-27 02:37:56.400 UTC (GitLab release timestamp) |
| Authority revision date | No separate authority revision date published; verified against the 2026-09-27 GitLab release and CNA record |
| Affected versions | hMailServer 6.0.0 through 6.3.3. The remote unauthenticated password, POP3 UID, and delivery-error paths require Windows event scripting, JScript, and a relevant handler; the rule Run-function path can involve either scripting language. |
| Fixed version | hMailServer 6.3.4 |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The notice distinguishes the JScript event-handler paths from the rule Run-function path, which can involve either scripting language. Keep those conditions intact. Disabling one handler is not a blanket guarantee for every path, and the recorded one-way database migration makes a simple binary downgrade an inadequate rollback plan.
What To Validate Now
- Inventory. Locate hMailServer 6.0.0 through 6.3.3, record operating system, event-scripting state and language, OnClientValidatePassword, OnExternalAccountDownload and OnDeliveryFailed handlers, rule Run-function permissions, service account, exposed POP3/SMTP/sign-in paths, database engine, data store, and owner.
- Establish applicability. Match the CNA range and vendor conditions exactly. The vendor says the password, POP3 UID, and delivery-error paths did not expose VBScript servers and that Linux builds had no script engine; it separately says a rule Run-function name reached the flaw in either scripting language.
- Remediate. Back up the database and data directory, validate restore readiness, and manually install hMailServer 6.3.4 from the vendor's GitLab release. Until upgrade, disable event scripting or remove the three named handlers and restrict rule creation or editing as directed by the vendor.
- Validate. Verify installer provenance, running version, database migration outcome, expected rule permissions, and inbound/outbound mail behavior. Exercise only the event handlers you deliberately use, with controlled messages. Keep a recovery plan for the database and data together, not only the application directory.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The vendor says live update will not install 6.3.4. The database migration has 64 one-way steps and may be lengthy on large stores, with database-version, privilege, and collation constraints. Test backup restoration and rollback boundaries before change; preserve the original configuration and scripts; do not infer exploitation from the Critical score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
