CVE-2026-100741 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-100741 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-100741 is a critical remote code execution flaw in Progressive Robot Ltd’s hMailServer for Windows affecting versions 6.0.0 through 6.3.3. A remote, unauthenticated attacker can trigger JScript injection in the mail server process by sending a crafted password or protocol value that contains a backslash followed by an apostrophe. In the right non-default configuration, this can execute arbitrary script as the hMailServer service account.

This is especially dangerous for solo developers and small teams because the attack can be reached over common mail protocols (SMTP AUTH, POP3, IMAP) and may lead to full takeover of the server, data theft, mailbox tampering, or lateral movement. The issue is not currently known to be exploited in the wild and is not in CISA KEV, but the severity is CRITICAL (CVSS 9.8) and the exposure is high if scripting is enabled.

Immediate Action

  • Upgrade hMailServer immediately to the first fixed release available from the vendor. If you do not yet know the patched version, use TODO: vendor-fixed version and confirm in the advisory before rollout.
  • Disable event scripting if you do not explicitly need it. This vulnerability requires event scripting to be enabled.
  • Switch script language away from JScript to VBScript if you must keep scripting enabled, since VBScript event scripts are not affected.
  • Temporarily isolate the mail server from the internet if you cannot patch today: restrict inbound SMTP/POP3/IMAP to trusted IPs or VPN only.
  • Review service account privileges and reduce them to the minimum needed. If compromise is suspected, rotate credentials and inspect outbound connections.
  • Check the vendor advisory and release notes: Progressive Robot Ltd hMailServer security advisory.

Affected Versions

  • hMailServer 6.0.0 through 6.3.3 on Windows are vulnerable.
  • hMailServer on Linux is not affected.
  • VBScript event scripts are not affected; the issue is in JScript event scripting.
  • Safe version: TODO: first fixed version and later.
  • Configuration required for exploitation: event scripting enabled, script language set to JScript, and a handler such as OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed defined.

Resolution Guide

There is no npm/pip/Maven package to upgrade here; this is a Windows mail server product. Use the vendor installer or your configuration management tool to deploy the fixed release.

# Windows: stop the service before upgrading
sc stop hMailServer

# Install the vendor-fixed version
# TODO: replace with the exact installer filename or package path
msiexec /i hMailServer-TOFIX.msi /qn

# Start the service after upgrade
sc start hMailServer

Hardening steps:

# In hMailServer Administrator:
# 1) Disable Event Scripting if not needed
# 2) If scripting is required, set Script language to VBScript
# 3) Remove or comment out handlers that are not essential

# Example policy: restrict mail access while patching
# Allow only trusted admin IPs to reach mail ports
netsh advfirewall firewall add rule name="hMailServer SMTP Restrict" dir=in action=allow protocol=TCP localport=25 remoteip=10.0.0.0/8
netsh advfirewall firewall add rule name="hMailServer POP3 Restrict" dir=in action=allow protocol=TCP localport=110 remoteip=10.0.0.0/8
netsh advfirewall firewall add rule name="hMailServer IMAP Restrict" dir=in action=allow protocol=TCP localport=143 remoteip=10.0.0.0/8

Code fix example for the vulnerable string handling pattern: ensure both apostrophes and backslashes are escaped before embedding values into JScript literals.

// Minimal defensive example
function jsStringEscape(s) {
  return String(s)
    .replace(/\\/g, '\\\\')
    .replace(/'/g, "\\'");
}

// Before: handler("value")
// After:
handler("'" + jsStringEscape(userValue) + "'");

Detection & Verification

Check whether you are vulnerable:

# Confirm product version in the UI or from installed files
# TODO: replace with your local path if needed
wmic product where "Name like 'hMailServer%'" get Name,Version

# Search configuration for event scripting and JScript
findstr /S /I "EventScripting JScript OnClientValidatePassword OnExternalAccountDownload OnDeliveryFailed" "C:\Program Files\hMailServer\*.ini" "C:\Program Files\hMailServer\*.txt" "C:\Program Files\hMailServer\*.vbs" "C:\Program Files\hMailServer\*.js"

Look for risky settings:

  • Event scripting enabled
  • Script language set to JScript
  • Any of the affected handlers defined
  • Unexpected service-account activity, child processes, or outbound connections from the mail server

Verify the fix:

# After upgrade, confirm version is above the vulnerable range
wmic product where "Name like 'hMailServer%'" get Name,Version

# Confirm scripting is disabled or set to VBScript
# TODO: check in hMailServer Administrator or config export

Optional log review: search for failed logons or unusual password patterns containing backslashes and apostrophes, plus any unexpected script execution or COM object creation around authentication events.

Risk and Impact

If exploited, an attacker can run arbitrary JScript inside the hMailServer service process with the privileges of the service account. In many small environments, that account has broad access to mail data, local files, and sometimes network resources, making this a potential full server compromise.

The blast radius includes mailbox theft, message tampering, credential harvesting, and pivoting to other systems if the service account is over-privileged. Even without known active exploitation, this is a high-priority patch because the attack is remote, unauthenticated, and reliable under the vulnerable configuration.

Keep reading